JP5072092B2 - Recovery control device, control method, program, and computer-readable storage medium - Google Patents

Description

  The present invention relates to a recovery control device, a control method, a program for causing a computer to execute the control method, and a program for executing the control method when a boot program stored in a nonvolatile memory such as a flash ROM is destroyed in an image forming apparatus or the like The present invention relates to a storage medium.

In recent years, controller software for image forming apparatuses is mostly stored in an electrically erasable / rewritable flash ROM. The advantage of this is that even after the product's official software is released and the product is manufactured, new software such as bug fixes and enhancements are often released, and software can be rewritten on the product. It is thought that it was popularized by sex.
In addition, the prior art regarding the recovery control apparatus by this invention is proposed (for example, refer patent document 1, 2, 3).
JP-A-8-69376 JP 2007-122151 A JP 2005-339271 A

However, in the field such as “customer” for the reasons mentioned above, there are many occasions when software rewriting work is performed, and there is an accident that rewriting fails due to power failure during the rewriting or careless power off. There was something to do. In this case, if the software boot area is broken due to rewriting failure, it cannot be started up even after the power is turned on, and software cannot be rewritten. In such a case, there is no means other than replacing the controller board itself or replacing the flash ROM in which software is written, resulting in an increase in the dead time of the machine.
In addition, there is no possibility of rewriting the boot area due to software runaway or garbled data in the flash ROM itself. When such a situation occurs, it can be started up even if the power is turned on, as in the case of software rewriting failure. Cannot be rewritten, and software cannot be rewritten. Moreover, it is generally impossible for the user to repair the device, and the device cannot be used until the repair by the service person, resulting in an increase in the dead time of the machine.

  The BIOS rewrite control circuit proposed in Patent Document 1 has a switching circuit that inverts the most significant address signal of the flash ROM, and logically divides the space of the flash ROM into two. By doing this, when updating the BIOS, the BIOS basic part is written while the BIOS basic part is written, and the BIOS basic part is written on the other side. Since the BIOS basic part that has been left remains, it can be activated and rewritten. However, the data to be written into the divided blocks is separate from the BIOS basic part and the BIOS extension part and is not duplicated as in the present invention, and is not particularly relevant to the present invention.

In the boot control device and boot control method proposed in Patent Document 2, two flash ROMs in which a boot program is written are provided, and the two flash ROMs are completely duplicated. When the system starts from one flash ROM, if it does not start normally after a predetermined time, it starts even if the boot program is destroyed by starting the boot from the other flash ROM. Making it possible. This technique is duplicated by two flash ROMs, and does not involve the user's intention in determining whether the system has started up normally or whether or not it is restored, and is a technique different from the present invention.
Patent Document 3 relates to a card-type memory used in an image forming apparatus and is not related to the present invention.
The present invention solves the above-described problems, and an object thereof is to reduce the dead time of a machine when a boot program is destroyed.

  A recovery control device according to the invention of claim 1 stores a boot program, divides the memory space into two logically upper bit areas and lower bit areas, and stores the same data in each bit area; Selection means for inverting / non-inverting the most significant address signal of the nonvolatile memory to logically replace each bit area, detection means for detecting the state of the selection means, and at the time of software activation by power-on, When the detection means detects that the selection means has selected non-inversion, normal system activation is performed, and when the detection means detects that the selection means has selected inversion, the lower bit area Control means for copying all data to all areas of the upper bit area is provided.

  A recovery control device according to a second aspect of the present invention stores a boot program, divides the memory space into two logically upper bit areas and lower bit areas, and stores the same data in each bit area; Selection means for inverting / non-inverting the most significant address signal of the nonvolatile memory to logically replace each bit area, detection means for detecting the state of the selection means, and at the time of software activation by power-on, When the detection means detects that the selection means has selected non-inversion, normal system startup is performed, and when the detection means detects that the selection means has selected inversion, the upper bit area is SUM value is calculated for each block for all blocks constituting the block and all blocks constituting the lower bit area, and the upper bit is calculated. When SUM value of the block of the block and the low-order bit area of the frequency does not match and is characterized in that a control means for copying the data block of the lower bit area into blocks of the upper bit area.

  According to a third aspect of the present invention, there is provided a recovery control apparatus according to the first aspect, wherein, when the detection means detects that the selection means has selected inversion, the control means performs the copy or the normal system. An input means is provided for the user to select and input whether to start.

Recovery control device according to the invention of claim 4, in claim 2, before when hexene-option means detects said detecting means that selects the inversion, performed copies using the SUM value to the control means Or an input means for allowing the user to select and input whether to perform normal system startup.

  A recovery control device according to a fifth aspect of the present invention is the recovery control device according to the first or second aspect, wherein the control means configures the upper bit area in the background when the CPU processing load is light after the normal system startup. SUM values are calculated in block units for all blocks and all blocks constituting the lower bit area, and when the SUM values of the upper bit area block and the lower bit area block do not match, an internal error is recorded. The normal SUM value is used to determine which one of the upper bit area block and the lower bit area block is correct, and the correct block data is copied to the wrong block. .

  A recovery control device according to a sixth aspect of the present invention is the recovery control device according to the first to fifth aspects, wherein the control means performs a version check of the upper bit area and the lower bit area when the normal system is started, and the version of the lower bit area is In the case of a version older than the upper bit area, the data of the upper bit area is copied to the lower bit area in the background.

  A recovery control device according to a seventh aspect of the present invention is the recovery control device according to the first or second aspect, wherein after the power-on reset is released, the address is inverted and the reset output is generated when there is no access from the control means within a certain period of time. And when the software is started by turning on the power, the control means accesses the monitoring means, and when the access is not made within the predetermined period, the monitoring means is configured to provide the highest address of the nonvolatile memory. The system is activated by inverting the signal and generating a reset output.

  A recovery control method according to an invention of claim 8 stores a boot program in a nonvolatile memory, logically divides the memory space into two upper bit areas and lower bit areas, and stores the same data in each bit area, By inverting / non-inverting the most significant address signal of the non-volatile memory, the bit areas can be logically interchanged, the inversion or non-inversion state is not detected, and when the software is started by turning on the power, When the non-inverted state is detected, normal system startup is performed, and when the inverted state is detected, all data in the lower bit area is copied to all areas in the upper bit area. It is.

  The recovery control method according to the invention of claim 9 stores a boot program in a nonvolatile memory, logically divides the memory space into two upper bit areas and lower bit areas, and stores the same data in each bit area, By inverting / non-inverting the most significant address signal of the non-volatile memory, the bit areas can be logically interchanged, the inversion or non-inversion state is not detected, and when the software is started by turning on the power, When the non-inverted state is detected, normal system startup is performed, and when the inverted state is detected, all blocks constituting the upper bit area and all blocks constituting the lower bit area are in block units. SUM value is calculated by the above, and the SUM value of the block in the upper bit area and the block in the lower bit area match. Itoki, is characterized in that copying the data block of the lower bit area into blocks of the upper bit area.

  According to a tenth aspect of the present invention, there is provided a recovery control method according to the eighth aspect, wherein when the inversion state is detected, the user is allowed to select whether to perform the copying or the normal system activation. To do.

According to an eleventh aspect of the invention, the recovery control method according to the ninth aspect of the invention is to perform copying using the SUM value or starting the normal system when detecting that the inverted state is selected in the ninth aspect. This is characterized in that the user is selected.

  A recovery control method according to a twelfth aspect of the present invention is the recovery control method according to the tenth aspect, wherein after the normal system startup, all blocks and lower bit areas constituting the upper bit area in the background when the CPU processing load is light SUM values are calculated in units of blocks for all the blocks constituting the block. When the SUM values of the upper bit area block and the lower bit area block do not match, an internal error is recorded and a normal SUM value is used. Thus, it is characterized in that it is determined whether the block in the upper bit area or the block in the lower bit area is correct, and the data of the correct block is copied to the incorrect block.

  A recovery control method according to a thirteenth aspect of the present invention is the recovery control method according to the eighth to twelfth aspects, wherein the version check of the upper bit area and the lower bit area is performed at the normal system startup, and the version of the lower bit area is older than the upper bit area In the case of the version, the data of the upper bit area is copied to the lower bit area in the background.

  According to a fourteenth aspect of the present invention, there is provided a recovery control method according to the eighth or ninth aspect, wherein the address is inverted and the reset output is generated when there is no access from the CPU within a certain period after the release of the power-on reset. The system is started by inverting the highest address signal of the non-volatile memory and generating a reset output when the software is not activated within a certain period when the power is turned on. To do.

  A program according to a fifteenth aspect of the invention causes a computer to execute the recovery control method according to any of the eighth to fourteenth aspects.

  A computer-readable storage medium according to a sixteenth aspect of the invention stores the program according to the fifteenth aspect.

  According to the present invention, the nonvolatile memory is logically divided into two and each divided area is completely duplicated to switch the selection means when software upgrade or memory data corruption occurs. Thus, the repair can be performed by copying from the other area to the area that has been destroyed, so that the dead time of the machine can be shortened.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 shows a recovery control apparatus according to the first embodiment.
In FIG. 1, a CPU 1, a switch SW, and a NOR circuit 3 control a recovery operation at the time of booting a flash ROM 2 as a nonvolatile memory in which a boot program is stored. This circuit is configured so that inversion / non-inversion of the most significant address signal of the flash ROM 2 (in this example, A21 because of 4 MB capacity and x16 bit data width) can be selected by the switch SW.

As shown in FIG. 2A, the memory space of the flash ROM 2 is logically divided into two areas, an upper bit area and a lower bit area. One of the two divided areas is referred to as Boot Block 4 and the other is referred to as Recovery Block 5. In this embodiment, the Boot Block 4 and the Recovery Block 5 are duplicated by making them completely the same data.
According to the above configuration, each bit area can be logically switched by switching the switch SW with the most significant address signal of the flash ROM 2.

  In order to make the CPU 1 recognize whether the most significant address signal is inverted or non-inverted, the inverted / non-inverted selection signal BOOT_RESCUE from the SW is input to the IO port of the CPU 1. When the address signal is inverted when the SW is turned on, the Rescue mode is set.

FIG. 3 is a flowchart showing the operation at the time of startup with the above configuration.
When the main power is turned on, booting is started from the boot vector (step S1, step abbreviated below). When SW is off, the most significant address signal A21 of the flash ROM 2 is non-inverted, so that booting is started from Boot Block 4. Since A21 is inverted when SW is on, booting is started from Recovery Block 5. When the boot is started, the CPU 1 reads the selection signal BOOT_RESCUE and determines (S2, S3). If BOOT_RESCUE is 1, it is determined that the system is normally activated (Normal mode), and normal system activation processing is executed.

When BOOT_RESCUE is 0, since some problem has occurred in the flash ROM 2 such as a software rewrite error, it is determined that the user or serviceman etc. operates the SW to request the recovery mode. In this case, all the data in Recovery Block 5 is copied to Boot Block 4 (S4). When the copying ends normally, the restoration of Boot Block 4 is completed. Therefore, the SW is turned off, and normal startup is executed by turning on the power.
FIG. 2B shows the relationship between Boot Block 4 and Recovery Block 5 depending on SW on / off.

  According to the present embodiment, when the boot area is destroyed due to failure in rewriting the software in the flash ROM 2, software runaway, garbled data in the flash ROM 2 itself, etc., the user automatically operates the recovery by operating the SW. Since the data of Block 5 is copied to Boot Block 4, the destroyed Boot area can be automatically recovered. For this reason, it is possible to shorten the dead time while calling the service person and waiting for the response.

FIG. 4 is a flowchart showing an operation at the time of startup according to the second embodiment. The circuit configuration is the same as in FIG.
Also in this flowchart, BOOT_RESCUE is read at the time of booting with the main power ON (S11), and it is determined whether the mode is the normal mode or the recovery mode (S12, S13). As in the first embodiment, if the Normal mode is selected, normal system startup is performed. If the Recovery mode is selected, it is determined that the recovery processing request is for Boot Block 4.

The flash ROM 2 is composed of a plurality of fine blocks, and can be erased and rewritten in units of blocks. In the present embodiment, copying is performed in units of small blocks, not the entire area copy of Recovery Block 5 as in the first embodiment.
That is, when BOOT_RESCUE = 0 (S14), the SUM value of each block is calculated from each head block of Boot Block 4 and Recovery Block 5 (S15) and compared (S16). If a mismatch occurs, the data of that block in Recovery Block 5 is copied to the corresponding block in Boot Block 4 (S17). The same comparison is made for Boot Block 4 and Recovery Block 5 for all blocks (S18, S19, S15), and when the processing is completed up to the last block, the recovery processing for Boot Block 4 is completed. Therefore, it is possible to start up normally by turning off the SW and turning on the power.

  According to the present embodiment, the Boot area is automatically recovered in a shorter time than the operation of the first embodiment by copying only the destroyed block instead of copying the entire area. The dead time between calling a service person and waiting for a response can be further shortened.

FIG. 5 is a flowchart showing the operation at the time of startup according to the third embodiment. The circuit configuration is the same as in FIG.
Also in this flowchart, as in the first and second embodiments, BOOT_RESCUE is read at the time of booting with the main power ON, and it is determined whether the mode is the normal mode or the recovery mode (S21, S22, S23). If in Normal mode, normal system startup is performed.

  If it is in the Recovery mode, it is determined that the recovery processing request is for Boot Block 4. As the recovery process, first, the user inputs a selection of the process. That is, it is selected whether to perform Boot Block 4 recovery or normal system startup (S24). If the recovery process of Boot Block 4 is not requested (S25, No), normal system startup is performed and the device is brought into a usable state. Such a request is not a time-consuming recovery process, but a request by the user to use the device as soon as possible, or a request from the user to use the device while saving an abnormal state for later mention to the manufacturer as a claim. Conceivable.

  On the other hand, when the recovery process of Boot Block 4 is requested (S25, Yes), the data of Recovery Block 5 is copied to Boot Block 4 (S26). When copying is completed normally, the restoration of Boot Block 4 is completed, and the SW is turned off and the power is turned on to start normally.

  According to the present embodiment, in addition to the effects of the first embodiment, the user's request to use the device immediately rather than performing the recovery, and the abnormal state is saved for later mention to the manufacturer as a claim However, the device can respond to the user's request to use it.

FIG. 6 is a flowchart showing the operation at the time of startup according to the fourth embodiment. The circuit configuration is the same as in FIG.
Also in this flowchart, as in the first to third embodiments, BOOT_RESCUE is read at the time of booting with the main power ON, and it is determined whether the mode is the normal mode or the recovery mode (S31, S32, S33). If in Normal mode, normal system startup is performed.

  If it is in the Recovery mode, it is determined that the recovery processing request is for Boot Block 4. As the recovery process, the user inputs a selection of the process. That is, it is selected whether to perform Boot Block 4 recovery or normal system startup (S34). When the recovery process of Boot Block 4 is not requested (S33, No), normal system activation is performed and the device is brought into a usable state.

  On the other hand, when the recovery process of Boot Block 4 is requested (S33, Yes), the entire area of the Recovery Block is copied instead of the entire area of the Recovery Block, as in the second embodiment and the recovery process. That is, when BOOT_RESCUE = 0 (S36), the SUM value of each block is calculated from each head block of Boot Block 4 and Recovery Block 5 (S37) and compared (S38). If a mismatch occurs, the data of that block in the Recovery Block 5 is copied to the corresponding block in the Boot Block 4 (S39). The same comparison is performed for Boot Block 4 and Recovery Block 5 for all blocks (S40, S41, S37), and when the processing is completed up to the last block, the recovery processing of Boot Block 4 is completed. Therefore, it is possible to start up normally by turning off the SW and turning on the power.

  According to the present embodiment, in addition to the effects of the third embodiment, the time required for the operation is shorter than the operation according to the third embodiment by copying only the destroyed block instead of copying the entire area. Since the Boot area is automatically recovered, dead time can be shortened.

FIG. 7 is a flowchart showing an operation at the time of activation according to the fifth embodiment. The circuit configuration is the same as in FIG.
Also in this flowchart, as in the first to fourth embodiments, BOOT_RESCUE is read at the time of booting with the main power ON, and it is determined whether the mode is the normal mode or the recovery mode (S51, S2, S53). If it is determined that the mode is the recovery mode, the recovery process shown in any of the first to fourth embodiments is performed.

  On the other hand, if it is determined that the Normal mode is selected, the normal system startup is performed, the device is started to a usable state, and the consistency of the Boot Block and Recovery Block is checked in the background when the processing load on the CPU 1 is light. To do.

  That is, when BOOT_RESCUE = 0 (S54), the SUM value is calculated from the first block of both blocks and compared (S56). If the SUM values match, the process proceeds to the next block (S57), and if the SUM values do not match, an internal error is recorded (S58). Error recording is performed by writing data to a non-volatile memory (NVRAM) or hard disk that will not be lost even when the power is turned OFF / ON. You can recognize what happened.

  After recording the error, the recovery processing of Boot Block 4 and Recovery Block 5 is started. First, the regular SUM value of the block is read (S59). Here, it is assumed that a regular SUM value is recorded in each area of Boot Block 4 and Recovery Block 5 for each block. Next, the read normal SUM value and the previously calculated SUM value are compared in the order of Boot Block 4 and Recovery Block 5, and the one with the calculated SUM value and the read normal SUM value matched is copied to the other block. (S60, S61 or S62, S63). When the SUM value calculated for both Boot Block 4 and Recovery Block 5 and the read regular SUM value do not match (S62, No), an error is displayed (S64), and the process is terminated. The above operations are performed up to the last block through S57, S65, S55, and S56.

  According to this embodiment, even if the occurrence of software runaway or garbled data in the flash ROM itself occurs outside the Boot area even in Recovery Block 5 or Boot Block 4, Since the repair is performed, the dead time can be shortened.

FIG. 8 is a flowchart showing the operation at the time of startup according to the sixth embodiment. The circuit configuration is the same as in FIG.
As in the first to fifth embodiments, BOOT_RESCUE is read at the time of booting with the main power ON, and it is determined whether the mode is the normal mode or the recovery mode (S71, S72, S73). The recovery process according to any one of the embodiments 1 to 4 is performed.

  On the other hand, if it is determined that the normal mode is selected, the normal system startup is performed, the device is started up in a usable state, and then written to Boot Block 4 and Recovery Block 5 in the background when the processing load of CPU 1 is light. The software version read is read (S74) and compared (S75). If the software version written in Boot Block 4 matches the software version written in Recovery Block, it is determined that the recovery block update process is unnecessary, and normal processing is continued.

On the other hand, if the software version written in Recovery Block 5 is older than the software version written in Boot Block, it is determined that the update process of Recovery Block 5 is necessary, and the entire area of Boot Block 4 is recovered. (S76). When copying is completed normally, normal processing continues.
By performing the above control, the need to be aware of Boot Block and Recovery Block in software upgrade work by service personnel etc. is eliminated, and software upgrades by service personnel can be handled only for Boot Block, Work time can be shortened.

  According to the present embodiment, when the flash ROM is completely doubled up and down, both when a version mismatch occurs in two blocks and when the software version is upgraded by a serviceman There is a problem that the block has to be upgraded, resulting in an increase in work time. However, even if a version mismatch occurs between two duplicated blocks, they are automatically matched. The work performed at the time of version upgrade can be made to upgrade only the Boot Block, and the work time can be shortened.

FIG. 9 is a block diagram showing a boot control apparatus according to the seventh embodiment. The parts corresponding to those in FIG.
In the present embodiment, a monitoring circuit 6 is added to the circuit configuration of FIG. The monitoring circuit 6 reverses the highest address to the flash ROM 2 and outputs a reset output if there is no access from the CPU 1 for a certain period after the power-on reset circuit 7 releases the power-on reset.

FIG. 10 shows a configuration example of the monitoring circuit.
The monitoring circuit 7 includes an address inverting circuit (ADDRESS inverting circuit) 8 that inverts / non-inverts the most significant address signal to the flash ROM 2, a timer (TIMER) 9, a control unit 10 that controls them, and the monitoring circuit 7 itself. It consists of a power-on reset device 11 for resetting. The inv / noninv # signal is a signal for controlling inversion / non-inversion of the address, and the initial value is noninv (non-inversion). The start signal is a timer start signal, the clear signal is a timer stop # and clear, and the timeout signal is a signal indicating that a predetermined time has elapsed.

The operation of the monitoring circuit 6 having the above configuration will be described.
After the power-on reset circuit 6 releases the power-on reset, the timer 9 is started. If the ACCESS signal is asserted from the CPU 1 before the timeout signal is asserted from the timer 8, the timer 9 is stopped and the operation of the monitoring circuit 6 is stopped.

  On the other hand, if the ACCESS signal from the CPU 1 is not asserted before the timeout signal is asserted from the timer 9, the clear signal is asserted to stop and clear the timer 8, and the inv / noninv # signal to the ADDRESS inversion circuit 8 Is controlled (inverted) to invert the highest address signal to the flash ROM 2 and simultaneously output a reset signal to the CPU 1 and the monitoring circuit 6. Since this reset output is wired-ORed to the power-on reset circuit 7 of the system, after the reset output of the monitoring circuit 6 is released, the start is started with the highest address signal inverted.

  The subsequent operation of the monitoring circuit 6 is to start the timer 9 in the same manner as after the power-on reset of the system is released, and when the ACCESS signal is asserted before time up, the timer 8 is stopped and the monitoring circuit 6 The operation ends. Even when the ACCESS signal is not asserted before time-up, the operation of the monitoring circuit 6 is stopped because both address non-inversion and inversion have already been performed. At this time, an output signal such as LED lighting may be provided to indicate that neither address inversion nor non-inversion has been started normally.

FIG. 11 is a flowchart showing the operation of the present embodiment.
When the main power is turned on, system booting is started (S81), and initial setting of each device is performed. Thereafter, the ACCESS signal output from the IO port 2 of the CPU 1 connected to the ACCESS port of the monitoring circuit 7 is asserted (S82). By performing such processing, the monitoring circuit 6 is made to recognize that the system has started up normally. Subsequently, BOOT_RESCUE is read (S83). If BOOT_RESCUE is 0 (S82, No), it is determined that the mode is Normal, and normal system activation processing is performed. The monitoring circuit 6 has already been stopped by asserting a signal to the ACCESS port, and the system enters a normal startup state.

  If BOOT_RESCUE is 1, it means that the address has already been reversed by the monitoring circuit 6 and the restart has already been performed, and a problem such as destruction of the boot program has occurred in the Boot Block 4. As the software processing, it is not particularly necessary to be aware of the behavior of the monitoring circuit 6. If BOOT_RESCUE is 1, it is determined that the mode is the recovery mode, and the recovery processing according to any of the first to fourth embodiments is performed. Good (S84).

  According to the present embodiment, when the Boot area described in the first to fourth embodiments is destroyed, the user does not need to operate the switch SW, and can be automatically restarted in the recovery mode. The load on the user can be reduced.

  According to the present embodiment, it consists of a power-on reset input and reset output, a timer, an address inversion circuit, and an address inversion / non-inversion selection signal. By providing a monitoring circuit that inverts and generates a reset output, and by controlling to always access the monitoring circuit when the software is started when the power is turned on, if the system does not start normally due to some problem, within a certain period of time In the first to fourth embodiments, the monitoring circuit is not accessed, and the monitoring circuit automatically starts the system by inverting the highest address signal of the flash ROM and generating a reset output. When the Boot area mentioned above is destroyed, there is no need for the user to operate the switch SW. It is possible to dynamic, it is possible to reduce the load on the user.

  The program for the CPU 1 to execute the processing shown in each flowchart in each of the above-described embodiments constitutes a program according to the present invention. The storage medium for recording the program constitutes a computer-readable storage medium according to the present invention. As this storage medium, a semiconductor storage device, an optical and / or magnetic storage device, or the like can be used. By using such a program and storage medium in an apparatus or system having a configuration different from the above-described embodiment and causing the CPU to execute the program, substantially the same effect as the present invention can be obtained. it can.

  According to the above-described embodiment, the dead time of the machine can be further shortened by copying a part of the destroyed area, instead of copying the entire area that has been further destroyed.

  Further, when the non-inverted state is detected when the data in the nonvolatile memory is destroyed or when the software is started by turning on the power, the normal system start-up is performed, and when the inverted state is detected, the system is repaired or the system is left as it is. Since the user is allowed to select whether to start up, it is possible to meet the demand of the user who wants to use the device more quickly than the time-consuming recovery.

  The time required when the user selects repair can be further shortened, and the dead time of the machine can be further shortened.

  Even if it starts normally, it can check the consistency of the written software by comparing the doubled areas, and even if the data in the non-volatile memory is corrupted, it is automatically repaired. It becomes possible and the reliability of the system is improved.

  In addition, the software version written in both bit areas when it is normally started is checked, and the software version of both blocks is automatically adjusted to match the software version by the service person. The upgrade work only needs to be performed in one area, and the work time of the service person can be shortened.

  In addition, by providing a monitoring means that reverses the highest address and generates a reset if it does not start normally, even if the system does not start normally due to some problem, it automatically starts from the duplicated area Since it starts, a user's load can be reduced.

  Further, the recovery control method according to the present invention can be performed using a computer.

It is a circuit diagram which shows the recovery control apparatus by the 1st-6th embodiment of this invention. It is a block diagram which shows embodiment of flash ROM. It is a flowchart which shows operation | movement of 1st Embodiment. It is a flowchart which shows operation | movement of 2nd Embodiment. It is a flowchart which shows operation | movement of 3rd Embodiment. It is a flowchart which shows operation | movement of 4th Embodiment. It is a flowchart which shows operation | movement of 5th Embodiment. It is a flowchart which shows operation | movement of 6th Embodiment. It is a circuit diagram which shows the recovery control apparatus by the 7th Embodiment of this invention. It is a block diagram which shows the monitoring circuit in FIG. It is a flowchart which shows operation | movement of 7th Embodiment.

Explanation of symbols

1 CPU
2 Flash ROM
3 NOR circuit SW switch 6 Power-on reset circuit 7 Monitoring circuit 8 ADDRESS inversion circuit 9 Timer

Claims (16)

A non-volatile memory that stores a boot program, logically divides the memory space into an upper bit area and a lower bit area, and stores the same data in each bit area;
Selection means for inverting / non-inverting the most significant address signal of the non-volatile memory to logically replace each bit area;
Detecting means for detecting a state of the selecting means;
When the detection means detects that the selection means has selected non-inverted when the software is started by turning on the power, the normal start-up of the system is performed, and the detection means detects that the selection means has selected inversion. In this case, the recovery control device is provided with control means for copying all data in the lower bit area to all areas in the upper bit area. A non-volatile memory that stores a boot program, logically divides the memory space into an upper bit area and a lower bit area, and stores the same data in each bit area;
Selection means for inverting / non-inverting the most significant address signal of the non-volatile memory to logically replace each bit area;
Detecting means for detecting a state of the selecting means;
When the detection means detects that the selection means has selected non-inverted when the software is started by turning on the power, the normal start-up of the system is performed, and the detection means detects that the selection means has selected inversion. In this case, SUM values are calculated for each block constituting the upper bit area and all blocks constituting the lower bit area, and the SUM of the upper bit area block and the lower bit area block is calculated. A recovery control device, comprising: a control means for copying data in a block in the lower bit area to a block in the upper bit area when the values do not match.   An input means for a user to select and input whether the control means performs the copying or the normal system activation when the detection means detects that the selection means has selected inversion; The recovery control device according to claim 1, wherein the recovery control device is provided. Before when hexene-option means detects said detecting means that selects the inverted or to perform copy with the SUM value to the control means, the user can select to perform the normal system boot 3. A recovery control apparatus according to claim 2, further comprising an input means for inputting the information.   The control means performs SUM in units of blocks for all blocks constituting the upper bit area and all blocks constituting the lower bit area in the background when the CPU processing load is light after the normal system startup. When the SUM value of the block in the upper bit area and the block in the lower bit area do not match, an internal error is recorded and the upper bit area block and the lower bit area are compared using the normal SUM value. 3. The recovery control apparatus according to claim 1, wherein which of the blocks is correct is determined, and the data of the correct block is copied to the incorrect block.   The control means performs a version check of the upper bit area and the lower bit area at the time of the normal system startup, and if the lower bit area version is older than the upper bit area, the upper bit area data is stored in the background. 6. The recovery control apparatus according to claim 1, wherein the recovery control apparatus copies to a lower bit area.   After releasing the power-on reset, there is provided monitoring means for inverting the address and generating a reset output when there is no access from the control means within a certain period of time. The monitoring means inverts the highest address signal of the non-volatile memory and generates a reset output when the access is not made within the predetermined period, and the system is started by generating a reset output. The recovery control apparatus according to claim 1 or 2, wherein A boot program is stored in a non-volatile memory, and the memory space is logically divided into an upper bit area and a lower bit area, and the same data is stored in each bit area.
By inverting / non-inverting the most significant address signal of the nonvolatile memory, the bit areas can be logically interchanged,
To detect the inversion or non-inversion state,
When the non-inverted state is detected when the software is started by turning on the power, normal system startup is performed, and when the inverted state is detected, all the data in the lower bit area is stored in the entire upper bit area. A recovery control method characterized by copying. A boot program is stored in a non-volatile memory, and the memory space is logically divided into an upper bit area and a lower bit area, and the same data is stored in each bit area.
By inverting / non-inverting the most significant address signal of the nonvolatile memory, the bit areas can be logically interchanged,
To detect the inversion or non-inversion state;
When the non-inverted state is detected when the software is started by turning on the power, normal system startup is performed. When the inverted state is detected, all blocks constituting the upper bit area and the lower bit area are SUM values are calculated in units of blocks for all of the blocks, and when the SUM values of the upper bit area block and the lower bit area block do not match, the lower bit area block data is converted to the upper bit area block A recovery control method characterized by copying to a computer.   9. The recovery control method according to claim 8, wherein when the inversion state is detected, the user is allowed to select whether to perform the copy or to perform the normal system startup.   10. The recovery according to claim 9, wherein when it is detected that the reverse state is selected, the user is allowed to select whether to perform copying using the SUM value or to perform the normal system startup. Control method.   After starting the normal system, in the background when the CPU processing load is light, calculate the SUM value in units of blocks for all blocks constituting the upper bit area and all blocks constituting the lower bit area, When the SUM value of the block in the upper bit area and the block in the lower bit area do not match, an internal error is recorded and whether the block in the upper bit area or the block in the lower bit area is correct using the regular SUM value 10. The recovery control method according to claim 8 or 9, wherein the right block data is copied to the wrong block.   When the normal system starts, the upper bit area and lower bit area are checked for version. If the lower bit area version is older than the upper bit area, the upper bit area data is copied to the lower bit area in the background. The recovery control method according to claim 8, wherein the recovery control method is performed.   After the power-on reset is released, the address is reversed and the reset output is generated when there is no access from the CPU within a certain period. When the software is started by turning on the power, the access is not performed within the certain period. 10. The recovery control method according to claim 8, wherein the system is started by inverting the highest address signal of the nonvolatile memory and generating a reset output.   The program which makes a computer perform the recovery control method described in any one of Claims 8-14.   A computer-readable storage medium storing the program according to claim 15.

Images