JP2004318871A - Communication device and its remote management system, OS update method, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To easily and surely discriminate a failure at the time of succeeding restart by turning on a power source even when updating is failed by power supply cutoff or the like in updating an OS by downloading the OS for updating from an external device such as a management apparatus. <P>SOLUTION: When there is a rewriting (updating) request of firmware (including the OS) from the management apparatus 3, the CPU 11 of communication equipment downloads firmware for rewriting from the management apparatus 3 and when it is made successful, an under-firm-rewriting flag within a flash ROM 13 is set to "1". When starting the communication equipment 1 (starting a boot loader) later, a state of the under-firm-rewriting flag is checked and when it is "0", the OS and an application within a card memory 15 are successively developed and started in a DRAM 12. When the under-firm-rewriting flag is "1", the OS and a recovery program within the flash ROM 13 are successively developed and started in the DRAM 12. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a communication device, a remote management system including the electronic device and a management device for remotely managing the electronic device via a network, a software update method in the electronic device, and a function required for a computer controlling the electronic device. The present invention relates to a program for realizing (a function according to the present invention) and a recording medium on which the program is recorded.

  Conventionally, including image processing devices such as printers, facsimile (FAX) devices, digital copiers, scanner devices, and digital multifunction devices with communication functions, network home appliances, vending machines, medical devices, power supplies, air conditioning systems, A communication device (electronic device) having a communication function in a measurement system such as gas, water, electricity, etc. is a managed device, and a management device of a service center (management center) as an external device is a network such as a public line or the Internet. There has been proposed a remote management system that remotely manages these managed devices via the Internet.

A communication device used in such a remote management system generally includes a CPU (central processing unit) for controlling the operation of the entire communication device, and software (program) for causing the CPU to perform the control. And a memory for storing.
Usually, a ROM is used as a memory for storing software, and the ROM stores a firmware including various parameters and program codes, including a program for controlling a basic operation of the communication device.

By the way, in order to improve the performance of the communication device or to solve the malfunction of the communication device, a design change or the like is performed, so that software (generally, firmware) needs to be updated (upgraded) in some cases. Note that examples of the firmware include an application (application program) and an OS (operating system).
Conventionally, software update of this type of communication device (including update such as rewriting of parameters) is performed by a service engineer (customer engineer) who visits a customer and checks the inside of the communication device installed at the customer. This was done by replacing the ROM.

  On the other hand, recently, when a communication device is shipped from a factory, software for controlling the operation of the communication device is written in a nonvolatile memory (non-volatile storage means) such as an EPROM (Erasable Programmable Read Only Memory) or a flash ROM. The non-volatile memory is mounted on the communication device. In this case, software is input using a predetermined device from the SCSI port, RS-232C port, IC card slot, or the like of the communication device, and the software of the non-volatile memory is used. Can be updated.

  However, in such a conventional communication device, software indicating the content of processing to be executed is directly burned into a ROM, and software is input from a SCSI port, an RS-232C port, an IC card slot, or the like as necessary. However, the method of updating software has the following problems (1) and (2), which requires a great deal of time and cost, and hinders improvement in serviceability.

(1) When software is burned into a ROM, it is necessary to exchange the ROM through a person for updating the software. As the number of ROMs to be replaced increases, enormous cost, person and time are spent. Would.
(2) The software can be updated only by replacing the ROM or at a local place from the SCSI port, RS-232C port, IC card slot, or the like. Therefore, the software of the communication device installed at a remote place is updated. Was done directly by a service engineer visiting the installation location or by sending the software in advance by other means, such as mailing, locally.

Therefore, in recent years, when an electrically rewritable nonvolatile memory is mounted, a communication device having a function of updating software in the nonvolatile memory based on software transmitted from an external device via a network or the like. Has been commercialized.
However, in such a communication device, if the update of the software fails due to a trouble such as a power shutdown during the update of the software, the software is damaged. In some cases, the software must be updated by inputting software from a SCSI port, RS-232C port, IC card slot, or the like, or by replacing a non-volatile memory.

Therefore, the system includes first and second nonvolatile memories, downloads update software (new version software) from an external device, and updates the software in the second nonvolatile memory based on the update software. (Rewrite to a new version) At the subsequent restart (when power is turned on), it is determined whether or not the software in the second nonvolatile memory is normal. If the software is normal, the software is replaced with the first. There has been proposed a communication device (for example, see Patent Document 1) having a function of starting (executing) software (for example, fixed software) in a nonvolatile memory.
JP-A-9-231032

  In such a communication device (for example, a personal computer), the software update is usually started by the operation of the device user. Therefore, even if the software update fails due to a power-off trouble during the software update, It is possible to immediately re-download the software, start the software update, and surely complete the software update.

  On the other hand, when there is a software update request from a management device that is an external device, a communication device of a type that automatically downloads update software from the external device and updates software in the second nonvolatile memory, In the communication device in the remote management system as described above, the device user does not always use the communication device during the software update, but even if the software update fails due to trouble at that time, the external device If there is a software update request again from the external device, it is possible to automatically redownload the update software from the external device, start the software update, and complete the software update.

For this reason, the management device (external device) needs to know the software update status of the communication device. However, conventionally, when the OS update fails on the communication device side, the fact is managed for the following reason. Because the device could not be notified, the software update request could not be issued again to the management device, and the communication device could not complete the OS update in some cases.
In the communication device described in Patent Literature 1, when an update OS is downloaded from the management device and the OS is updated, even if the OS update fails due to a trouble such as power shutoff during the OS update. However, the failure cannot be determined at the time of restarting after the power is turned on.

  That is, when the communication device is restarted by turning on the power, the boot loader (boot program) stored in the ROM or the like is started before the OS is started, so that the boot loader needs to check whether the OS update is successful. There is. However, this boot loader can determine the presence or absence of an OS in the second nonvolatile memory by referring to identification information such as its name. However, the boot loader checks the contents of the OS and determines whether or not the OS is normal. I can't judge. Therefore, even if the OS update has failed, it cannot be determined.

  SUMMARY OF THE INVENTION The present invention has been made in view of the above-described problems, and in a case where a communication device downloads an update OS from an external device such as a management device and updates the OS, the problem is caused by the occurrence of a trouble such as power shutdown. It is an object of the present invention to be able to easily and surely determine the failure of an OS update at the time of a restart after power-on, even if the update fails.

  In order to achieve the above object, the present invention provides a communication device, a remote management system for the communication device, a control method when an abnormality occurs in the communication device, and a function required for a computer controlling the communication device. Provide a program.

  A communication device according to claim 1, wherein the first and second nonvolatile storage means, a download means for downloading an update OS from the external device when an OS update request is received from the external device, Communication means having an OS updating means for updating the OS in the first and second non-volatile storage means based on the OS downloaded by the downloading means, and the downloading of the updating OS by the downloading means is successful. A first state information control unit that sets updating information indicating that the OS is being updated in the first nonvolatile storage unit, and checks whether or not the updating information is set when the communication device is activated, If the updating information is not set, the OS in the second non-volatile storage means is changed. If the updating information is set, the OS in the first non-volatile storage means is changed. Those that provided the OS starting means for starting the S, respectively.

According to a second aspect of the present invention, in the communication device of the first aspect, when the OS in the first nonvolatile storage unit is activated by the OS activation unit, an OS update failure is notified to the external device. This is provided with an OS update failure notifying means for notifying.
A communication device according to a third aspect of the present invention is the communication device according to the first or second aspect, wherein the download unit transmits the OS update failure notification to the external device by the OS update failure notification unit from the external device. When an OS update request is made again, a means for downloading an update OS from the external device is provided.

  A communication device according to a fourth aspect of the present invention is the communication device according to any one of the first to third aspects, wherein after the updating information is set in the OS updating unit by the first state information control unit, the updating is performed. Means for updating the OS in the second non-volatile storage means based on the OS for use. When the update by the means is successful, the setting of the updating information is canceled and the update indicating completion of the OS update is performed. There is provided second state information control means for setting completion information in the first nonvolatile storage means.

  A communication device according to a fifth aspect of the present invention is the communication device according to any one of the first to fourth aspects, wherein the OS in the second nonvolatile storage unit is activated by the OS activation unit, and the update completion information is set. If the update has been performed, an OS update completion notifying unit that notifies the external device of the completion of the OS update, and a third state information control unit that cancels the setting of the update completion information after the notification by the unit is completed. After the setting of the update completion information is canceled by the third state information control means in the OS update means, the first nonvolatile memory is stored on the basis of the OS in the second nonvolatile storage means. It has means for updating the OS in the storage means.

  A remote management system according to a sixth aspect of the present invention is a remote management system for remotely managing a plurality of communication devices via a network by a management device, wherein the communication device includes first and second nonvolatile storage means, Download means for downloading an update OS from the management apparatus when an OS update request is received from the management apparatus; and an OS in the first and second nonvolatile storage means based on the OS downloaded by the means. OS update means for updating the OS, and first state information control means for setting update-in-progress information indicating that the OS is being updated in the first nonvolatile storage means when the download of the update OS by the download means succeeds. When the communication device is activated, it is checked whether or not the updating information has been set. If the updating information has not been set, the second failure is checked. The OS of the nonvolatile the storage means, when the updating information is set is provided with a an OS starting means for starting each OS in the first nonvolatile storage means.

A remote management system according to a seventh aspect of the present invention is the remote management system according to the sixth aspect, wherein the OS in the first non-volatile storage unit is activated in the communication device by the OS activation unit. An OS update failure notifying means for notifying the management device of the update failure together with the identification information of the communication device is provided.
The remote management system according to claim 8 is the remote management system according to claim 6 or 7, wherein the communication device periodically inquires the communication device whether there is a transmission request to the management device. A download unit of the communication device, and in response to an inquiry of the transmission request to the management device by the transmission request presence / absence inquiry unit, when the management device issues an OS update request, the management device By requesting the update OS from the management apparatus.

A remote management system according to a ninth aspect of the present invention is the remote management system according to any one of the sixth to eighth aspects, wherein a notification of the OS update failure to the management device is sent to the download unit of the communication device by the OS update failure notification unit. A means for downloading an update OS from the management device by requesting the update device from the management device when an OS update request is received again from the external device. .
According to a tenth aspect of the present invention, in the remote management system according to any one of the sixth to ninth aspects, the updating information is set in the OS updating unit of the communication device by the first state information control unit. And updating the OS in the second non-volatile storage means based on the OS for updating, and when the updating by the means is successful, the communication device sets the updating-in-progress information. A second state information control means for canceling the OS update and setting the update completion information indicating the completion of the OS update in the first nonvolatile storage means is provided.

  The remote management system according to an eleventh aspect of the present invention is the remote management system according to the sixth to tenth aspects, wherein the OS in the second nonvolatile storage unit is activated by the OS activation unit in the communication device, and the update is performed. When the completion information is set, the OS update completion notifying means for notifying the management device of the completion of the OS update together with the identification information of the communication device, and setting the update completion information after the notification by the means is completed. And third state information control means for canceling the update completion information in the OS update means after the setting of the update completion information is canceled by the third state information control means. Means for updating the OS in the first nonvolatile storage means based on the OS.

  The OS updating method according to the twelfth aspect of the present invention provides a first and second non-volatile storage means, and an updating OS downloaded from an external device, and the first and second non-volatile storage means are downloaded based on the OS. An OS update method in a communication device for updating an OS, wherein when an OS update request is received from an external device, an update OS is downloaded from the external device, and when the download is successful, the OS update is performed. After setting the updating information shown in the first non-volatile storage means, the OS in the second non-volatile storage means is updated based on the OS for updating, and when the communication apparatus is started, the updating is performed. It is checked whether or not information has been set. If the updating information has not been set, the OS in the second nonvolatile storage means has been set. If the updating information has been set, the OS has not been updated. Non-volatile storage means The OS and is intended to activate respectively.

An OS updating method according to a thirteenth aspect of the present invention is the OS updating method according to the twelfth aspect, wherein when the OS in the first non-volatile storage unit is activated, the OS updating failure is notified to the external device. is there.
An OS update method according to a fourteenth aspect of the present invention is the OS update method according to the twelfth or thirteenth aspect, wherein, in response to the OS update failure notification to the external device, an OS update request is again issued from the external device. And downloading the update OS from the external device.

In the OS updating method according to the invention of claim 15, in the OS updating method according to any one of claims 12 to 14, when the OS in the second nonvolatile storage means has been successfully updated, the setting of the updating information is performed. At the same time, the update completion information indicating the OS update completion is set in the first nonvolatile storage means.
According to a sixteenth aspect of the present invention, in the OS updating method according to any one of the twelfth to fifteenth aspects, the OS in the second nonvolatile storage unit is activated and the update completion information is set. In this case, the completion of the OS update is notified to the external device. After the notification is completed, the setting of the update completion information is released, and the first device is reset based on the OS in the second nonvolatile storage means. This is for updating the OS in the non-volatile storage means.

  A program according to the invention of claim 17 downloads an update OS from an external device to a computer controlling a communication device having first and second nonvolatile storage means when an external device requests an OS update. A first status information control function for setting, in the first nonvolatile storage means, updating information indicating that the OS is being updated when the update OS is successfully downloaded by the function; When the apparatus is started, it is checked whether or not the updating information has been set. If the updating information has not been set, the OS in the second nonvolatile storage means is updated and the updating information is set. In this case, an OS start function for starting the OS in the first nonvolatile storage means is realized.

The program according to claim 18 is the program according to claim 17, wherein when the OS in the first nonvolatile storage unit is activated by the OS activation function in the computer, the OS update failure is notified to the external device. This is also for realizing an OS update failure notification function for notifying the device.
The program according to claim 19 is the program according to claim 17 or claim 18, wherein the download function notifies the external device of the OS update failure notification by the OS update failure notification function. It has a function of downloading an update OS from the external device when there is an update request.

  According to a twentieth aspect of the present invention, in the program according to any one of the seventeenth to nineteenth aspects, after the updating information is set in the computer by the first state information control function, the computer is configured to execute the updating OS based on the updating OS. An OS update function for updating the OS in the second nonvolatile storage means, and when the update by the function is successful, cancels the setting of the update-in-progress information and updates the update completion information indicating the completion of the OS update. This is also for realizing a second state information control function set in the first nonvolatile storage means.

A program according to a twenty-first aspect of the present invention is the program according to any one of the seventeenth to twentieth aspects, wherein the OS in the second nonvolatile storage unit is activated by the OS activation function in the computer, and the update completion information is updated. Is set, an OS update completion notification function for notifying the external device of the OS update completion, and a third state information control for canceling the setting of the update completion information after the end of the notification by the function. A function is also realized, and after the setting of the update completion information is released to the OS update function by the third state information control function, the OS update function is executed based on the OS in the second nonvolatile storage means. This is provided with a function of updating the OS in the first nonvolatile storage means.
A recording medium according to a twenty-second aspect of the present invention is a computer-readable recording medium storing the program according to any one of the seventeenth to twenty-first aspects.

  According to the present invention, when the communication device downloads an update OS from an external device such as a management device and updates the OS, even if the OS update fails due to a trouble such as a power shutdown, The failure can be easily and reliably determined at the time of restarting when the power is turned on. Therefore, the OS for update can be immediately downloaded again to start the update of the OS, so that the update of the OS can be surely completed.

Hereinafter, the best mode for carrying out the present invention will be specifically described with reference to the drawings.
First, a configuration example of a remote management system using a communication device according to the present invention as a managed device will be described. FIG. 1 is a conceptual diagram showing an example of the configuration of the remote management system.

  The remote management system includes image forming apparatuses such as printers, fax machines, digital copiers, and digital multifunction peripherals, image processing apparatuses such as scanner apparatuses, image processing apparatuses such as scanner apparatuses, network home appliances, vending machines, medical equipment, A communication device (electronic device) 1 (1a, 1b, 1c, 1d, 1e, 1f, 1g) having a communication function in a power supply device, an air-conditioning system, a gas / water supply / electricity metering system, or the like is defined as a managed device. Remote management system. As an external device (as viewed from the communication device side) connected to each communication device 1, as a server device connected to each communication device 1 via the Internet 5 (or another network such as a public line). A functioning management device 3 is provided so that the management device 3 can centrally remotely manage each communication device 1 via the Internet 5. As the public line (or dedicated line), there are a fixed telephone line such as an analog line, an ADSL line, a digital line (ISDN line) and a line using an optical fiber, and a mobile telephone line such as a mobile telephone line and a PHS line.

For example, in the installation environment A shown in FIG. 1, the communication devices 1a and 1b capable of establishing a direct connection with the management device 3 by HTTP (Hyper Text Transfer Protocol) are used. In the installation environment B, the communication devices 1a and 1b are directly connected by the management device 3 and HTTP. In the installation environment C, communication devices 1f, 1g capable of establishing a direct connection with the management device 3 by HTTP are installed, respectively.
In each of the installation environments A, B, and C, a firewall 7 (7a, 7b, 7c) is installed in consideration of security.

In such a remote management system, each communication device 1 has an application (application program) for its own control management.
The management device 3 is equipped with an application for performing control management of each communication device 1. Then, each of the communication devices 1 in the remote management system notifies, by RPC (remote procedure call), a “request” that is a request for processing for a method of an application to be mounted on each other, and based on a result of the requested processing. A certain "response" can be obtained.

That is, the communication device 1 can generate a request to the management device 3 and transfer (notify) the request to the management device 3 and obtain a response to the request, while the management device 3 transmits the request to the communication device 1. A request is generated and delivered to the communication device 1, and a response to the request can be obtained.
In order to realize RPC, known protocols (communication standards) such as SOAP (Simple Object Access Protocol), HTTP, FTP (File Transfer Protocol), COM (Component Object Model), and CORBA (Common Object Request Broker Architecture). , Technology, specifications, etc. can be used.

The data transmission / reception model of this transmission / reception is shown in the conceptual diagram of FIG.
(A) is a case where a request to the management device 3 has occurred in the communication device 1. In this case, the communication device 1 generates a communication device-side request a, and the management device 3 that has received the request a returns a response a to the request. (A) shows a case in which not only the response a but also the response delay notification a 'is returned. This is because when the management device 3 receives the request on the communication device side and determines that the response to the request cannot be returned immediately, it notifies the response delay notification and disconnects the connection state once. This is because a response to the above request is newly delivered.

  (B) is a case where a request for the communication device 1 is generated in the management device 3. In this case, the management device 3 generates a management device-side request b, and the communication device 1 that has received the request b returns a response b to the request. In the case of (B), returning the response delay notification b 'when the response cannot be returned immediately is the same as the case of (A).

Next, the hardware configuration of the communication device 1 will be described with reference to FIG.
FIG. 3 is a block diagram illustrating an example of a hardware configuration in the communication device 1.
The communication device 1 includes a CPU 11, a DRAM 12, a flash ROM 13, a card memory controller 14, a card memory 15, a real-time clock circuit (RTC) 16, a modem 17, an NCU (network control device) 18, NICs 19 and 20, a power supply circuit 21, and the like. It is constituted by.

The CPU 11 controls the operation of the communication device 1 based on various programs (software) including an OS (operation system) that controls the basic operation in the DRAM 12, and controls the operation of the communication unit 1 by using the NCU 18 or the NICs 19 and 20. Central processing for controlling the communication device 1 as a whole, such as controlling transmission and reception of various data (or signals) to and from the management device 3 via the Internet 5 and making a call to the management device 3 via a public line. Device.
The DRAM 12 is a program memory for storing various programs including the OS, and a main memory used as a work memory used when the CPU 11 performs data processing. Note that an SRAM may be used instead of the DRAM 12.

  The flash ROM 13 includes a boot loader memory for storing a boot loader (boot program) for activating the communication device 1, an OS image memory for storing an OS image, which is an OS file, and a firmware rewriting flag indicating that the firmware is being rewritten. A firmware rewriting completion flag (including update completion information indicating OS update completion) flag memory indicating a firmware rewrite completion, a recovery program memory storing a recovery program for executing firmware rewriting, Transmission data from one of the management device 3 and each of the communication devices 1 to the other, device number information (identification information) for identifying one of the communication devices 1, an IP address of a communication destination of the management device 3, Phone number (call destination A non-volatile memory (first non-volatile storage means) used as a data memory (data area) for storing the number of recalls (the number of retries) when the line connection is not successful, the number of retry calls, etc. Yes, the stored contents are retained even when the power is turned off. Instead of the flash ROM 13, another nonvolatile memory such as an EEPROM may be used.

The card memory controller 14 controls reading and writing of various data from and to the card memory 15.
The card memory 15 is a recording medium such as an SD memory, and includes an OS image memory for storing an OS image, an application memory for storing an application (application program), and a non-volatile memory (second memory) used as a data memory for storing various data. 2 non-volatile storage means). In this embodiment, the application and the OS image (OS file) are firmware, but any one of them or other data may be firmware.
Instead of the flash ROM 13 and the card memory 15, a large-capacity storage device (large-capacity storage means) such as a hard disk device can be used. Alternatively, only one storage device such as the flash ROM 13 or a large-capacity storage device may be used as the non-volatile storage means, and a storage area used as the flash ROM 13 and a storage area used as the card memory 15 may be secured there. Good.

The real-time clock circuit 16 generates time information, and the CPU 11 can read the information to know the current time.
The modem 17 is a modulation / demodulation unit, and when transmitting data to the management device 3 via a public line, modulates the data so that the data can be transmitted to the public line. When receiving the modulated data sent from the management device 3, the data is demodulated.
The NCU 18 controls communication (data transmission / reception) with various external devices including the management device 3 via a public line.
The NICs 19 and 20 control communication with other communication devices on a LAN (or another network), and control communication with various external devices including the management device 3 via the Internet 5.
The power supply circuit 21 converts AC power (commercial power) from the AC adapter 22 into DC power and supplies the DC power to the above-described units in the communication device 1.

Here, the modem 17 and the CPU 11 communicate with the data lines of the transmission data (TX) and the reception data (RX), the transmission enable signal (CTS), the transmission request signal (RTS), the data set ready signal (DSR), and the carrier detection. The modem 17 controls according to a transmission request signal (RTS) from the CPU 11 and a carrier detection signal (DCD).
Further, the NCU 18 and the modem 17 are connected by signal lines for reception data (RXD) and transmission data (TXD). The reception data (RXD) is an analog signal modulated by the modem of the management device 3, and the transmission data (TXD) is an analog signal modulated by the modem 17.

Next, a hardware configuration of the management device 3 will be described with reference to FIG.
FIG. 4 is a block diagram illustrating an example of a hardware configuration in the management device 3.
The management device 3 includes a modem 31, a communication terminal 32, a proxy (Proxy) server 33, an operator terminal 34, a database 35, a control device 36, and the like.
The modem 31 communicates with the communication device 1 on the device user side (customer using the communication device 1) via a public line, and modulates and demodulates data to be transmitted and received.
The communication terminal 32 controls communication by the modem 31.
The proxy server 33 performs communication with the communication device 1 on the device user side via the Internet 5 and security management.

The operator terminal 34 receives input of various data by an operation on an input device such as a keyboard or a pointing device (such as a mouse) by an operator. The input data includes customer information such as their IP addresses and telephone numbers (call destination telephone numbers) used when communicating with the communication device 1 of each device user.
The database 35 exists in a large-capacity storage device such as a hard disk device of a server (not shown), and operates customer information of each device user, firmware for updating the communication device 1 (new version firmware), and CPU of the control device 36. It stores various software including a program for causing the data to be transmitted, data received from the communication device 1, data input from the operator terminal 34, and the like.
The control device 36 includes a microcomputer including a CPU, a ROM, a RAM, and the like (not shown), and controls the entire management device 3 as a whole. The CPU operates according to a predetermined program in the database 35.

Hereinafter, a processing operation which is a feature of this embodiment in the remote management system configured as described above will be specifically described with reference to FIGS.
First, an outline of an operation at the time of activation by the CPU 11 of the communication device 1 will be described with reference to FIG.
FIG. 5 is a flowchart illustrating an example of an outline of an operation at the time of activation by the CPU 11 of the communication device 1.
The CPU 11 of the communication device 1 starts the operation of FIG. 5 according to the boot loader in the flash ROM 13 when the power is turned on (power is supplied from the power supply circuit 21).

First, in step S1, it is checked whether or not the firmware rewriting has been completed normally by referring to the firmware rewriting flag in the flash ROM 13. If not, the OS in the flash ROM 13 is updated in step S4. Start.
That is, an OS image in the flash ROM 13 is read, loaded into the DRAM 12 and expanded into a usable OS, and then the OS is started.
Next, a recovery process described later is performed in step S5.
That is, the recovery program in the flash ROM 13 is read, loaded into the DRAM 12 and expanded, and then the recovery program is started to perform the recovery process.

On the other hand, if the rewriting of the firmware has been completed normally, the OS in the card memory 15 is started in step S2.
In other words, the controller reads the OS image in the card memory 15 by controlling the card memory controller 14, loads it into the DRAM 12, expands it into a usable OS, and then activates the OS.
Then, upon normal startup, the operation proceeds to the normal operation mode in step S3.
In this mode, if there is any request, an operation (normal operation) according to the request is performed. At this time, a required application is read from the card memory 15 as necessary, loaded into the DRAM 12, expanded, and activated.

  Here, when the CPU 11 of the communication device 1 operates based on the boot loader in the flash ROM 13, the function as the OS starting means operates based on the OS and the recovery program expanded in the DRAM 12, thereby inquiring the presence or absence of the transmission request. Means, download means, first state information control means, OS update means, second state information control means, OS start means, OS update failure notification means, OS update failure notification means, third state information control means Functions as various means can be realized respectively.

  Next, details of an operation at the time of activation (including restart) by the CPU 11 of the communication device 1 and an outline of an operation relating to updating (rewriting) of firmware by the management device 3 will be described with reference to FIGS. Here, it is assumed that the communication device 1 communicates with each other via the Internet 5 by using the NIC 19 or 20, and the management device 3 uses the proxy server 33, respectively. When the management device 3 uses the modem 31 and the communication terminal 32, respectively, it is possible to communicate with each other via a public line (not shown).

6 and 7 are flowcharts showing a detailed example of the operation at the time of startup by the CPU 11 of the communication device 1.
FIG. 8 is an explanatory diagram illustrating an example of a communication sequence between the communication device 1 and the management device 3.
The CPU 11 of the communication device 1 starts the operations of FIGS. 6 and 7 when the power is turned on (supply from the power supply circuit 21), first starts the boot loader in the flash ROM 13 in step S11, and follows the flash loader in step S12 according to the boot loader. The status (presence / absence) of a firmware rewriting flag (hereinafter also referred to as “firmware rewriting flag”) in the ROM 13 is checked. If the firmware rewriting flag is reset to “0” (setting is released), the process proceeds to step S13. If it is set (set) to "1", the process moves to step S26.

In step S13, an OS image (OS for normal operation of the communication device 1) in the card memory 15 is read, and loaded into the DRAM 12 and expanded to a usable OS.
When the deployment of the OS to the DRAM 12 is completed, the OS is started in step S14, and the process proceeds to step S15.
In step S15, an application (application for normal operation of the communication device 1) in the card memory 15 is read out, loaded into the DRAM 12, expanded, and then activated. By starting this application, the operation as the communication device 1 becomes possible.
Thereafter, in step S16, the state of the firmware rewrite completion flag (hereinafter also referred to as "firmware rewrite completion flag") in the flash ROM 13 is checked. If the firmware rewrite flag is reset to "0", the flow proceeds to step S20, and "1" If set to step S17, the process moves to step S17.

In the normal operation mode in step S20, as described above, if there is any request, an operation (normal operation) according to the request is performed.
During this normal operation mode, the process periodically proceeds to step S21. If there is no firmware rewrite request (hereinafter also referred to as “firmware rewrite request”) from the management device 3 via the Internet 5, the process returns to step S20. If there is, move to step S22. Then, firmware (for example, a new version of an OS, an application, or both) for rewriting (updating) is downloaded from the management device 3.

Here, the communication device 1 performs time management using a timer (not shown) in order to enable communication with the management device 3 via the firewall 7. For example, as shown in FIG. Also, polling (inquiry as to whether there is a transmission request) is periodically performed via the Internet 5.
When there is firmware for rewriting in the database 35, the control device 36 of the management device 3 requests the communication device 1 to rewrite the firmware by polling from one of the communication devices 1.
When receiving a firmware rewrite request from the management device 3, the CPU 11 of the communication device 1 notifies the management device 3 that the firmware rewrite request has been received (response), and then sends the rewriting firmware to the management device 3. Request.
Upon receiving a request for the firmware for rewriting from the polling source communication device 1, the control device 36 of the management device 3 downloads the firmware for rewriting in the database 35 to the communication device 1.

When the firewall 7 is provided on the communication device 1 side and the firewall 7 is set so as not to pass a communication request from the management device 3 to the communication device 1, the management device 3 Even if a firmware rewrite request is made, the request is blocked by the firewall 7 and does not reach the communication device 1. However, when polling is performed from the communication device 1 to the management device 3 and the firewall 7 is set to pass a communication request from the management device 3 to the communication device 1, the management device 3 performs polling. Upon receiving the request, a firmware rewrite request is made to the communication device 1, and the request reaches the communication device 1 via the firewall 7.
If it is not necessary to consider security aspects on the communication device 1 side, the firewall 7 may not be provided, or the firewall 7 may be set to pass a communication request from the management device 3 to the communication device 1. In this case, if the management device 3 issues a firmware rewrite request to the communication device 3 without receiving polling from the communication device 1, the request reaches the communication device 1.

When the download of the rewriting firmware from the management device 3 is completed, the CPU 11 of the communication device 1 checks the result of the download in step S24 of FIG. 6. If the download has failed, the CPU 11 of the communication device 1 The management device 3 is notified together with the identification information, and the process returns to step S20. The reason that the download of the rewriting firmware has failed is notified to the management device 3 so that the management device 3 can recognize that the download has failed and have the same rewriting firmware sent again.
If the download of the rewriting firmware is successful, the process proceeds to A in FIG. 7, and in step S33, the fact that the download of the rewriting firmware is successful is notified to the management device 3 together with the identification information of the communication device 1, and in step S34, The firmware rewriting flag in the flash ROM 13 is set to “1”.

Thereafter, the firmware in the card memory 15 is rewritten based on the firmware for rewriting downloaded in step S35.
That is, if the downloaded firmware for rewriting is an application, the application in the card memory 15 is rewritten to the downloaded application. If the downloaded rewriting firmware is an OS and an application, the OS and the application in the card memory 15 are rewritten to the downloaded OS and the application.

When the rewriting of the firmware is completed, it is checked in step S36 whether the rewriting has succeeded or failed. If the rewriting has failed, the process proceeds to step S39.
If the firmware has been successfully rewritten, the firmware rewriting flag in the flash ROM 13 is reset to “0” in step S37, and the firmware rewriting completion flag is set to “1” in step S37. Is restarted, and the flow shifts to B in FIG. 6 to execute the processes after step S11 again.

  If the firmware rewriting has succeeded, the firmware rewriting flag in the flash ROM 13 has been reset to “0”, and the firmware rewriting completion flag has been set to “1”, the processing in steps S11 to S15 is performed. In order to determine “1” in the status check of the firmware rewrite completion flag in step S16, the firmware rewrite completion is notified to the management device 3 together with the identification information of the communication device 1 in step S17, and the firmware rewrite in the flash ROM 13 is performed in step S18. After resetting the completion flag to “0”, the firmware in the flash ROM 13 is rewritten based on the rewritten firmware in the card memory 15 in step S19. However, the rewriting is performed only when the rewritten firmware in the card memory 15 includes the OS.

Here, if the power is turned off due to an erroneous operation of the device user while the firmware is being rewritten in step S35 of FIG. 7, the firmware rewriting flag in the flash ROM 13 holds “1”. ing.
Then, when the power is turned on again in this state, the CPU 11 restarts the operation of FIG. 6, starts the boot loader in the flash ROM 13 in step S11 in the same manner as described above, and follows the flash loader in step S12 in accordance with the boot loader. Check the status of the firmware rewriting flag in the box.

In this case, since the firmware rewriting flag in the flash ROM 13 is “1”, it is determined that rewriting of the OS image in the card memory 15 has failed, and the process proceeds to step S26.
In step S26, the rescue OS image in the flash ROM 13 is read, and the rescue OS image is loaded into the DRAM 12 and developed into a usable OS.
When the development of the rescue OS in the DRAM 12 is completed, the OS is started in step S27, and the process proceeds to step S28.
In step S28, the recovery program in the flash ROM 13 is read, loaded into the DRAM 12 and expanded, and then the recovery program is started.

Thereafter, in accordance with the recovery program, the fact that rewriting (updating) of the rewriting firmware has failed is notified to the management device 3 together with the identification information of the communication device 1 in step S29, and the process proceeds to step S30. If not, error processing such as displaying on the display unit (not shown) that the rewriting of the firmware has failed is performed in step S32, and the processing ends. The reason that the rewriting of the rewriting firmware has failed is notified to the management device 3 in order to make the management device 3 recognize that the rewriting has failed and to have the same rewriting firmware sent again.
If there is a firmware rewrite request from the management device 3, a download of the rewrite firmware is requested to the management device 3 in step S31, and the rewrite firmware is downloaded from the management device 3 in step S23. Is repeated.

According to the communication device 1 of this embodiment, the following effects (1) to (8) can be obtained.
(1) When the CPU 11 of the communication device 1 downloads the rewriting firmware from the management device 3 when the management device 3 requests rewriting (update) of the firmware (including the OS), and the download is successful. Then, the firmware rewriting flag in the flash ROM 13 is set to "1", and when the communication device 1 is subsequently activated (boot loader activation), the status of the firmware rewriting flag is checked, and the firmware rewriting flag is set to "0". When the firmware and the firmware in the flash ROM 13 are set to “1”, the OS and the application in the card memory 15 are sequentially developed in the DRAM 12 and activated. The recovery program is sequentially developed in the DRAM 12 and activated. When the rewriting firmware is downloaded from the management device 3 and the rewriting of the firmware is performed, even if the rewriting of the firmware fails due to power shutdown (other trouble may occur), the rewriting is not performed when the power is turned on again. Failure can be determined easily and reliably.

(2) When the CPU 11 of the communication device 1 sequentially develops and starts the OS and the recovery program in the flash ROM 13 in the DRAM 12 as described above and starts the firmware rewriting failure together with the identification information of the communication device 1 By notifying the firmware 3, the firmware for rewriting can be re-downloaded from the management device 3 and the rewriting of the firmware can be started, so that the rewriting of the firmware can be surely completed.

(3) After the CPU 11 of the communication device 1 sets the firmware rewriting flag in the flash ROM 13 to “1”, the CPU 11 of the communication device 1 rewrites the firmware in the card memory 15 based on the rewriting firmware, thereby rewriting from the management device 3. Even if the rewriting of the firmware fails due to power shutdown while downloading the firmware for firmware and rewriting the firmware, the failure can be easily and reliably determined at the time of restarting after the power is turned on. .

(4) In response to the firmware rewriting failure notification to the management device 3, the CPU 11 of the communication device 1 re-downloads the firmware for rewriting and re-downloads the firmware for rewriting when the management device 3 requests the rewriting of the firmware again. By starting the rewriting, the rewriting of the firmware can be completed more reliably.

(5) When the CPU 11 of the communication device 1 receives a firmware rewrite request from the management device 3 again in response to the notification of the firmware rewrite failure to the management device 3, the communication device notifies the communication device 1 that the firmware rewrite request has been received. By notifying the management device 3 together with the identification information of the communication device 1, the management device 3 can confirm that the communication device 1 has received the firmware rewrite request. Can be kept.

(6) The CPU 11 of the communication device 1 periodically inquires of the management device 3 whether there is a transmission request, and in response to a firmware rewrite request from the management device 3 in response to the inquiry, the management is performed. By requesting the device 3 for the rewriting firmware, the rewriting firmware can be downloaded from the management device 3. Therefore, if the management device 3 has the rewriting firmware, it is possible to reliably receive the firmware rewriting request from the management device 3. it can.

(7) After the CPU 11 of the communication device 1 sets the firmware rewriting flag in the flash ROM 13 to “1”, rewrites the firmware in the card memory 15 based on the rewriting firmware downloaded from the management device 3, If the rewriting is successful, the firmware rewriting flag in the flash ROM 13 is reset to “0”, and the firmware rewriting completion flag is reset to “1”, thereby referring to the state of the firmware rewriting completion flag. Thus, it is possible to reliably recognize that the rewriting of the firmware in the flash ROM 13 has been completed.

(8) When the firmware in the card memory 15 is activated and the firmware rewrite completion flag in the flash ROM 13 is set to “1”, the CPU 11 of the communication device 1 notifies the management device 3 of the completion of the firmware rewrite. After the completion of the notification, the firmware rewriting completion flag is reset to “0”, and the firmware in the flash ROM 13 is rewritten based on the firmware in the card memory 15, so that even when the subsequent firmware rewriting fails, the firmware is relatively new. Processing can be performed using firmware.

  The program according to the present invention is provided to a computer that controls the communication device 1 by sending a transmission request presence / absence inquiry unit, a download unit, a first state information control unit, an OS update unit, a second state information control unit, and an OS start unit. , An OS update failure notifying unit, an OS update failure notifying unit, and a third state information control unit, and a program for realizing functions as various units including the third state information control unit. Such effects can be obtained.

Such a program may be stored in a storage means such as a ROM or an HDD provided in the computer from the beginning, but may be stored in a non-volatile storage medium such as a CD-ROM or a flexible disk, an SRAM, an EEPROM, or a memory card as a recording medium. It can also be provided by recording it on a medium (memory). Each of the above-described procedures can be executed by installing the program recorded in the memory in the computer and causing the CPU to execute the program, or reading and executing the program from the memory by the CPU.
Further, the program can be downloaded from an external device provided with a recording medium storing the program or an external device having the program stored in the storage means and executed.

  The present invention can be applied to various communication devices having communication functions, including network home appliances, vending machines, medical devices, power supply devices, air conditioning systems, gas / water / electricity metering systems, and the like, and computers connectable to networks. (Managed device), and is applicable to a remote management system including the communication device and a management device that manages the communication device.

1 is a conceptual diagram illustrating a configuration example of a remote management system in which a communication device according to the present invention is a managed device. FIG. 2 is a conceptual diagram showing a data transmission / reception model in the remote management system. FIG. 2 is a block diagram illustrating an example of a hardware configuration of the communication device 1 in FIG. 1. FIG. 2 is a block diagram illustrating an example of a hardware configuration in a management device 3 in FIG. 1. FIG. 4 is a flowchart illustrating a schematic example of an operation at the time of startup by a CPU 11 of FIG. FIG. 3 is a flowchart showing a detailed example of an operation at the time of activation. It is a flowchart which shows the continuation. FIG. 3 is an explanatory diagram illustrating an example of a communication sequence between the communication device 1 and the management device 3 in FIG. 1.

Explanation of reference numerals

1: Communication device 3: Management device 5: Internet 7: Firewall 11: CPU 12: DRAM 13: Flash ROM 14: Card memory controller 15: Card memory 16: Real time clock circuit 17: Modem 18: NCU 19, 20: NIC 21 : Power circuit 31: Modem 32: Communication terminal 33: Proxy server 34: Operator terminal 35: Database 36: Control device

Claims (22)

First and second non-volatile storage means, download means for downloading an update OS from the external device when an OS update request is received from the external device, and the first and second nonvolatile storage means based on the OS downloaded by the means. 1, a communication device having an OS updating unit for updating an OS in a second nonvolatile storage unit,
A first state information control unit that sets updating information indicating that an OS is being updated in the first nonvolatile storage unit when the download of the update OS by the download unit is successful;
When the communication device is started, it is checked whether or not the updating information has been set. If the updating information has not been set, the OS in the second nonvolatile storage means is set. And OS activation means for activating each of the OSs in the first non-volatile storage means. The communication device according to claim 1,
A communication device, comprising: an OS update failure notifying unit that notifies the external device of an OS update failure when the OS in the first nonvolatile storage unit is activated by the OS activation unit. The communication device according to claim 1 or 2,
The download unit downloads the update OS from the external device when the external device again receives an OS update request in response to the OS update failure notification to the external device by the OS update failure notification unit. A communication device comprising means. The communication device according to any one of claims 1 to 3,
The OS updating means includes means for updating an OS in the second nonvolatile storage means based on the updating OS after the updating information is set by the first state information control means. ,
A second state information control means is provided for canceling the setting of the updating information when the updating by the means is successful and for setting the update completion information indicating the completion of the OS update in the first nonvolatile storage means. A communication device, characterized in that: The communication device according to any one of claims 1 to 4,
An OS update completion notifying unit for notifying the external device of an OS update completion when the OS in the second nonvolatile storage unit is activated by the OS activation unit and the update completion information is set; ,
A third state information control unit configured to cancel the setting of the update completion information after the notification by the unit is completed;
After the setting of the update completion information is canceled by the third state information control means, the OS update means stores the information in the first nonvolatile storage means based on the OS in the second nonvolatile storage means. A communication device having means for updating the OS of the communication device. A remote management system for remotely managing a plurality of communication devices via a network by the management device,
First and second non-volatile storage means in the communication device, download means for downloading an update OS from the management apparatus when an OS update request is received from the management apparatus, and download means for downloading the update OS from the management apparatus; OS update means for updating the OS in the first and second nonvolatile storage means based on the OS, and updating information indicating that the OS is being updated when the download of the update OS by the download means is successful. A first state information control unit to be set in the first non-volatile storage unit; and a check whether or not the updating information is set when the communication device is started, and when the updating information is not set, Means for activating the OS in the second nonvolatile storage means, and the OS in the first nonvolatile storage means when the updating information is set. Remote management system, characterized in that a. The remote management system according to claim 6,
When the OS in the first nonvolatile storage unit is activated by the OS activation unit in the communication device, an OS update failure notification that notifies the management device of an OS update failure together with the identification information of the communication device. A remote management system comprising means. The remote management system according to claim 6 or 7,
The communication device is provided with a transmission request presence / absence inquiry means for periodically inquiring whether the management device has a transmission request,
The download unit of the communication device, when an OS update request is received from the management device in response to the transmission request inquiry to the management device by the transmission request presence inquiry unit, updates the management device A remote management system, which is means for downloading an update OS from the management device by requesting the OS. The remote management system according to any one of claims 6 to 8,
The download unit of the communication device updates the management device when the external device again requests an OS update in response to the OS update failure notification to the management device by the OS update failure notification unit. A remote management system having means for downloading an update OS from the management device by requesting the update OS. The remote management system according to any one of claims 6 to 9,
The OS updating means of the communication device updates the OS in the second nonvolatile storage means based on the updating OS after the updating information is set by the first state information control means. Has,
A second state in which, when the update by the unit is successful, the setting of the updating information is canceled and the update completion information indicating the completion of the OS update is set in the first nonvolatile storage unit in the communication device. A remote management system comprising information control means. In the remote management system according to any one of claims 6 to 10,
In the communication device, when the OS in the second nonvolatile storage unit is started by the OS start unit and the update completion information is set, the OS update completion is notified together with the identification information of the communication device. OS update completion notifying means for notifying the management device, and third state information control means for canceling the setting of the update completion information after completion of the notification by the means,
After the setting of the update completion information is canceled by the third state information control means, the OS update means stores the information in the first nonvolatile storage means based on the OS in the second nonvolatile storage means. A means for updating the OS of the remote control system. First and second nonvolatile storage means, and an OS update method in a communication device for downloading an update OS from an external device and updating the OS in the first and second nonvolatile storage means based on the OS And
When an OS update request is received from an external device, an update OS is downloaded from the external device,
If the download is successful, updating information indicating that the OS is being updated is set in the first nonvolatile storage unit, and then the OS in the second nonvolatile storage unit is updated based on the update OS. And
When the communication device is started, it is checked whether or not the updating information has been set. If the updating information has not been set, the OS in the second nonvolatile storage means is set. An operating system (OS) in the first non-volatile storage means, if the setting has been performed, respectively. The OS updating method according to claim 12,
When the OS in the first non-volatile storage unit is activated, an OS update failure is notified to the external device. 14. The OS updating method according to claim 12, wherein
An OS update method, comprising downloading an update OS from the external device when an OS update request is again issued from the external device in response to the OS update failure notification to the external device. The OS update method according to any one of claims 12 to 14, wherein
When the update of the OS in the second nonvolatile storage means is successful, the setting of the updating information is canceled, and update completion information indicating the completion of the OS update is set in the first nonvolatile storage means. An OS update method characterized by the above-mentioned. The OS update method according to any one of claims 12 to 15,
When the OS in the second nonvolatile storage unit is activated and the update completion information is set, the completion of OS update is notified to the external device;
After the notification is completed, the setting of the update completion information is released, and the OS in the first nonvolatile storage is updated based on the OS in the second nonvolatile storage. OS update method. A computer for controlling a communication device having first and second nonvolatile storage means;
A download function for downloading an update OS from the external device when an OS update request is received from the external device; and updating-in-progress information indicating that the OS is being updated when the update OS is successfully downloaded by the function. A first state information control function to be set in the first nonvolatile storage means, and the presence or absence of the setting of the updating information is checked when the communication device is started, and when the updating information is not set, A program for realizing an OS in the second nonvolatile storage unit and an OS start function for starting the OS in the first nonvolatile storage unit when the updating information is set. . The program according to claim 17,
To the computer,
A program for realizing an OS update failure notification function of notifying the external device of an OS update failure when the OS in the first nonvolatile storage unit is activated by the OS activation function. The program according to claim 17 or 18,
The download function downloads an update OS from the external device in response to an OS update request from the external device in response to the OS update failure notification to the external device by the OS update failure notification function. A program having a function. The program according to any one of claims 17 to 19,
To the computer,
After the updating information is set by the first state information control function, an OS updating function of updating the OS in the second nonvolatile storage means based on the updating OS, and updating by the function is performed. If successful, a program for canceling the setting of the updating information and also realizing a second state information control function of setting update completion information indicating OS update completion in the first nonvolatile storage means. . The program according to any one of claims 17 to 20, wherein
To the computer,
An OS update completion notification function for notifying the external device of an OS update completion when the OS in the second nonvolatile storage unit is activated by the OS activation function and the update completion information is set; A third state information control function for canceling the setting of the update completion information after the notification by the function ends,
After the OS update function cancels the setting of the update completion information by the third state information control function, the OS update function stores the update completion information in the first nonvolatile storage means based on the OS in the second nonvolatile storage means. A program having a function of updating an OS of the computer.   A computer-readable recording medium recording the program according to any one of claims 17 to 21.

Images