300, it is desirable to use a relatively small-capacity storage from the point of view of the small size of the firmware and the features of the present disclosure.

The RAM 303 is a main memory and is used as a work area for image data and a temporary storage area for loading various control programs from the eMMC 302.

The operation unit OF 304 controls inputting/outputting of information via the operation panel.

The reading unit OF 306 controls inputting/outputting of information to/from the scanner 307.

The printing unit I/F 308 controls inputting/outputting of information to/from the printer 309.

The USB I/F 310 controls communication by a USB host and a USB device. Note that the numbers of USB hosts and USB devices are not limited.

The network I/F 312 is a communication interface for communicating with another apparatus via the network 100. The network I/F 312 enables wireless communication such as Wi-Fi communication (wireless LAN communication) according to a wireless standard (IEEE802.11), and wired communication using an Ethernet cable or the like according to a wired communication standard (IEEE802.3).

The short-range wireless communication I/F 313 is a communication interface for realizing a direct connection in a local environment, such as NFC (Near Field Communication), Bluetooth®, or the like.

The details of the data structure in the eMMC 302 are described below. FIG. 5A is a diagram illustrating the data structure in the eMMC in the image forming apparatus.

As shown in FIG. 5A, the eMMC 302 includes a boot area 510, a normal firmware area 520, a device configuration information area 530, a firmware update management area 540, and a firmware URI storage area 550.

The boot area 510 is an area in which boot data 511 is stored. The boot data 511 includes a program to be read at an initial stage when the power of the MFP 300 is turned on.

The normal firmware area 520 is an area in which normal firmware 521 for realizing main functions of the MFP 300 is stored. The normal firmware area has a storage capacity of, for example, about 10 GB, and serves as a data area in which data having a size equal to or more than half the capacity of the eMMC 302 is stored.

The device configuration information area 530 is an area for storing device configuration information.

The firmware update management area 540 is an area in which a firmware update status flag is stored.

The firmware URI storage area 550 is an area for storing a URI from which the firmware can be downloaded.

Details of the boot data 511 stored in the boot area 510 are described below. FIG. 5B is a diagram illustrating the data structure of the boot storage area.

The boot data 511 includes a boot control program 512, a firmware update control program 513, an application control program 514, a storage control program 515, and a communication control program 516.

The boot control program 512 is a part that is started first by the CPU 301 when the power of the MFP 300 is turned on. The boot control program 512 performs processing for activating the boot data 511, other programs, and the normal firmware 521 depending on the situation.

The firmware update control program 513 is a program that performs processing related to the firmware update. At least a part of the recovery program processing (FIG. 14) and the firmware update processing (FIG. 15), which will be described later, is executed by the update control program 513.

The application control program 514 exchanges information with an application executed by the information processing terminal 400 when communicating with the information processing terminal 400.

The storage control program 515 is a program used when the MFP 300 is recovered using a recovery medium (such as a USB memory).

The communication control program 516 is a program for controlling communication. The communication control program 516 holds programs for communication via Wi-Fi, USB, NFC, and Bluetooth® depending on the configuration of the MFP 300. Note that the communication control program 516 does not include data for encrypted communication due to a storage capacity limitation.

Therefore, the communication control program 516 is used for non-secure communication and local communication.

Details of the normal firmware 521 stored in the normal firmware area 520 are described below. FIG. 5C is a diagram showing a data structure of an area in which normal firmware can be stored.

The normal firmware 521 includes a UI control module 522, a firmware update control module 523, a job control module 524 and a device control module 525.

The UI control module 522 has information necessary for the user I/F, such as language data, bitmap data, voice guidance data, and the like.

The firmware update control module 523 and the job control module 524 each have a program corresponding to each function provided by the MFP 300. Specific examples of the programs are a facsimile job control program, a copy job control program, a scan job control program, and a print job control program.

The device control module 525 includes programs for controlling various components of the MFP 300. Specific examples of the programs are a facsimile engine control program, a scan engine control program, a print engine control program, and the like. The device control module 525 also includes a communication control program 526. It is assumed that the communication control program 526 includes data and the like for encrypted communication. Therefore, the communication control program 526 is used for general communication such as communication via the Internet.

In the present embodiment, the UI control module, the job control module, and the device control module are included in one piece of firmware for simplicity of the explanation, but they may be divided into separate pieces of firmware.

Firmware Management Server

FIG. 2 is a diagram illustrating a configuration of the firmware management server.

The firmware management server 200 includes a controller 250 and an operation unit 206.

The operation unit 206 is a user interface that displays information to the user and accepts an operation from the user. The operation unit 206 includes a display that displays information to the user, a touch panel that detects an input from the user, and a hard key. More specifically, for example, the operation unit 206 performs displaying information to a server administrator, various setting/inputting operations from the server administrator, and the like.

The controller 250 is a control unit for performing various controls in the firmware management server 200.

The controller 250 includes a CPU 201, a ROM 202, a RAM 203, a storage 204, an operation unit OF 205, and a network OF 207. These components are communicatively connected via a bus 209.

The CPU 201 reads control programs stored in the ROM 202 and executes various processes for controlling the operation of the firmware management server 200.

The ROM 202 stores programs for controlling the firmware management server 200 and various control programs for firmware management.

The RAM 203 is used as a main memory of the CPU 201 and as a temporary storage area such as a work area.

The storage 204 stores configuration information of the firmware management server 200, firmware that operates on the MFP 300, and the like. The storage 204 also stores applications (including a dedicated recovery driver, and various drivers for controlling printers and scanners) that run on the information processing terminal 400.

The operation unit OF 205 is an interface for controlling the operation unit 206.

The network OF 207 is an interface for performing data communication with an external apparatus via the network 100.

The data structure in the storage 204 in the firmware management server 200 is described below. FIG. 18 is a diagram illustrating data held by the firmware management server.

The storage 204 is configured for respective software groups corresponding to models and includes software information on MFXXXX 1810, software information on MFYYYY 1820, software information on MFOOOO 1830, and the like.

Each piece of software information includes firmware information (1811, 1821, 1831) and application information (1814, 1824, 1834).

The MFXXXX software information 1810 includes MFXXXX firmware information 1811 and MFXXXX application information 1814. The MFXXXXX firmware information 1811 includes latest normal firmware 1812 and a serial number list 1813. In the present embodiment, it is assumed that the latest version of firmware is stored, but a plurality of versions of firmware may be stored.

It is assumed that the serial number list 1813 indicates serial numbers that the MFXXX can have. However, the serial number list 1813 may include not only such serial numbers but also various other model-specific information.

The MFXXXX application information 1814 includes a normal driver 1815 for controlling functions such as functions of a scanner, a printer, and a facsimile of MFXXXX. The MFXXXX application information 1814 also includes a recovery program 1816 that is used, when MFXXXX is in a malfunctioning state, to restore it to a normal state.

Information Processing Terminal

FIG. 4 is a diagram illustrating a configuration of the information processing terminal. The information processing terminal 400 is a device capable of communicating with the MFP 300. Examples of the information processing terminal 400 include a mobile terminal such as a smartphone and a tablet device, as well as a PC (Personal Computer).

The information processing terminal 400 includes a controller 450, an operation unit 406 and a camera 413.

The operation unit 406 is a user interface that displays information to the user and accepts input of information from the user. The operation unit 406 includes a display that displays information, a touch panel that accepts a user operation, and a hard key.

The camera 413 is an imaging unit capable of capturing an image. The camera 413 captures a still image, a moving image, or the like, and reads a QR code (registered trademark) or the like according to the present disclosure.

The controller 450 is a control unit that performs various controls in the information processing terminal 400.

The CPU 401 reads control programs stored in the ROM 402 and executes various processes such as acquisition of firmware that operates on the MFP 300 from the firmware management server 200.

The ROM 402 stores a program for controlling the firmware management server 200 and various control programs for firmware management.

The RAM 203 is used as a main memory of the CPU 201 and as a temporary storage area such as a work area.

The storage 404 stores configuration information of the firmware management server 200, update firmware for a plurality of models, and the like. The storage 404 also stores images captured by the camera 413 and/or the like.

The operation unit I/F 405 is an interface that controls input/output via the operation unit 406.

The USB I/F 407 is an interface that controls wired communication (USB communication) by a USB host and a USB device. There may be a plurality of USB hosts and USB devices.

The network I/F 410 is an interface for communicating with an external apparatus via the network 100. For example, the network I/F 410 transmits and receives image data and print data to and from the MFP 300.

The short-range wireless communication I/F 411 is a communication interface for realizing direct connection in a local environment, such as NFC (Near Field Communication) and Bluetooth®.

The camera I/F 412 is an interface that accepts input of data captured by the camera 413.

Control of Image Forming Apparatus

The details of the control of the MFP 300 are described below.

FIG. 13 is a flowchart illustrating a processing flow performed in the image forming apparatus when the power of the image forming apparatus is turned on. This flowchart is implemented by the controller 350 (especially the CPU 301) executing one or more programs.

When the MFP 300 is turned on, supplying of power to the controller 350 is started.

In S1301, the CPU 301 starts the boot control program 512.

In S1302, the CPU 301 executes the boot control program 512 and accesses the firmware update management area 540 to check the update status of the normal firmware and to check whether or not the firmware is in a malfunctioning state. In a case where the CPU 301 determines that the firmware is in a malfunctioning state (YES), the process proceeds to S1303. In a case where the CPU 301 determines that the firmware is not in a malfunctioning state (NO), the process proceeds to S1311. More specifically, in a case where the “update-in-progress” flag is set in the firmware update management area 540, it is determined that the firmware is in a malfunctioning state. In a case where the “update-in-progress” flag is not set in the firmware update management area 540, it is determined that the firmware is not in a malfunctioning state.

In S1303, the CPU 301 determines whether or not it is possible to extract the communication control program 526 from the malfunctioning normal firmware area 520. In a case where the CPU 301 determines that the extraction is possible (YES), the process proceeds to S1304, but in a case where it is determined that the extraction is impossible (NO), the process proceeds to S1312.

In S1304, the CPU 301 confirms whether or not Wi-Fi communication can be used for recovery, that is, whether or not Wi-Fi communication is configured to be available.

In a case where the CPU 301 determines that Wi-Fi communication can be used (YES), the process proceeds to S1305, but in a case where it is determined that Wi-Fi communication cannot be used (NO), the process proceeds to S1306. In the following description of the present embodiment, it is assumed that the MFP 300 can use at least USB communication.

In S1305, the CPU 301 executes the communication control program 516 and activates a software AP mode or a direct connection mode. Thereafter, information for wireless LAN communication with the MFP 300 is displayed on the operation panel 305. FIG. 11A is a diagram illustrating an example of a screen in recovery request processing. A screen 1101 displays information for wirelessly connecting to the MFP 300. On the screen 1101, SSID and PASS (KEY), or a QR code for acquiring them, and a short-range wireless icon are displayed. The KEY is an encryption key required for the wireless connection. Examples of KEY are a password, PSK-AES, a WEP key, a security key, and the like.

SSID and PASS may be obtained by decoding the QR code, or may be obtained by receiving them via short-range wireless communication. The information displayed on the screen 1101 may be changed depending on the configuration of the MFP 300. For example, the QR code and the short-range wireless icon may be switched between displayed/hidden states.

In S1306, the CPU 301 executes the communication control program 516 and prepares for USB connection. The operation panel 305 then displays information to prompt to establish a wired connection to the MFP 300. FIG. 11B is a diagram illustrating an example of a screen in recovery request processing. A screen 1102 displays a message prompting for USB connection.

In response to the display of screen 1101 or screen 1102, the user performs a procedure on an application of the information processing terminal 400 to establish a connection. FIG. 12 is a diagram illustrating screen transitions on a terminal in the recovery processing. A screen 1210 is a menu screen provided by the printer management application. A firmware update button 1211 and a recovery button 1212 are displayed on the screen 1210. In the present example, it is assumed that the recovery button 1212 is selected, and the screen transitions to a screen 1220. A Wi-Fi button 1221 and a USB button 1222 are displayed on the screen 1220. The user selects the Wi-Fi button 1221 in S1305 or the USB button 1222 in S1306. When the Wi-Fi button 1221 is selected, the screen transitions to a screen 1230. On the screen 1230, an acquisition button 1231, an acquisition button 1232, an SSID input field 1233, and a PASS input field 1234 are displayed. In a case where the user selects the acquisition button 1231, the information processing terminal 400 is connected to the MFP 300 and SSID and PASS are acquired via the short-range wireless communication OF 313 and the short-range wireless communication I/F 411. In a case where the user selects the acquisition button 1232 and reads the QR code displayed on the MFP 300 with the camera 413, SSID and PASS are acquired. When either one of the above two acquisition methods is executed or manual input is performed, the SSID input field 1233 and the PASS input field 1234 are filled. After completing the input, the user selects the NEXT button 1235.

When the USB button 1222 is selected, a message screen (not shown) prompting for a USB connection is displayed. According to the displayed guidance, the user connects the MFP 300 and the information processing terminal 400 via a USB cable.

After that, in S1307, the CPU 301 confirms whether or not the information processing terminal 400 is connected by any method. In a case where the CPU 301 determines that the connection is not established (NO), the process proceeds to S1304. In a case where the CPU 301 determines that the connection is established (YES), the process proceeds to S1308.

In S1308, the CPU 301 receives a recovery request from the information processing terminal 400. In response, the CPU 301 transmits the device information of the MFP 300 to the information processing terminal 400. When the information processing terminal 400 receives the device information, the display transitions to a screen 1240. The screen 1240 is a screen for the user to allow the reception of data for recovery.

The screen 1240 has a start button 1241. When the start button 1241 is selected, the information processing terminal 400 receives the recovery program from the firmware management server. When the reception is completed, the screen transitions to a screen 1250. The screen 1250 indicates that the data for recovery has been received. The screen 1250 includes a next button 1251. When the next button 1251 is selected, the screen transitions to a screen 1260. The screen 1260 displays information for confirming the communication method for recovery processing. The screen 1260 has a start button 1261. When the start button 1261 is selected, the information processing terminal 400 transmits the received recovery program to the MFP 300.

In S1309, the CPU 301 receives the recovery program from the information processing terminal 400, loads it in the RAM 303, and starts it.

In S1310, the CPU 301 executes recovery program processing. Details of the recovery program processing will be described later.

In S1311, the CPU 301 determines whether or not the firmware update flag is set.

The firmware update flag is a flag that is set when a firmware update instruction is issued during a normal firmware activation. If the firmware update flag is set (YES), the CPU 301 advances the process to S1312. However, if the firmware update flag is not set (NO), the process proceeds to S1313.

In S1312, the CPU 301 executes the firmware update processing. Details of the firmware update process will be described later.

In S1312, the CPU 301 activates the normal firmware and starts a normal operation.

Recovery Program Processing

The recovery program processing in S1310 is described in detail below.

FIG. 14 is a flowchart illustrating processing executed by the recovery program. This flowchart is implemented by the controller 350 (especially the CPU 301) executing one or more programs.

In S1401, the CPU 301 loads the communication control program 526 into the RAM 303 and executes it.

In S1402, the CPU 301 determines whether an Internet connection is possible.

In S1403, the CPU 301 requests authentication from the firmware management server 200 and acquires the authentication result. In the following description, it is assumed that the authentication is successful.

In S1404, the CPU 301 controls the operation panel 305 to request the user to input network settings. Here, it is assumed that an input has been made.

In S1405, the CPU 301 completely erases the normal firmware area 520.

In S1406, the CPU 301 starts downloading the latest firmware and storing it in the normal firmware area 520. In S1407, the CPU 301 determines whether or not the latest firmware has been stored. If it is determined that the storing of the latest firmware is not completed (NO), the CPU 301 continues the processing in S1406 until the storing of the latest firmware storage is completed. If the storing of the latest firmware storage is completed (YES), the process proceeds to S1408.

In S1408, the CPU 301 deletes the “update-in-progress” flag from the firmware update management area 540 (for example, the flag is changed from the “update-in-progress” state to the “update completed” state (=idling state). This indicates that the malfunctioning state has been removed.

In step S1409, the CPU 301 performs reboot processing to reboot the MFP 300 with the normal firmware.

Firmware Update Process

The firmware update processing in S1312 is described in detail below.

FIG. 15 is a flowchart illustrating firmware update processing. This flowchart is implemented by the controller 350 (especially the CPU 301) executing one or more programs.

In S1501, the CPU 301 loads the communication control program 526 into the RAM 303 and executes it.

In S1502, the CPU 301 determines whether an Internet connection is possible.

In S1503, the CPU 301 issues a firmware list acquisition request and receives a notification whether the requested firmware is available or not. Here, it is assumed that the received notification indicates that the requested firmware is available.

In S1504, the CPU 301 controls the operation panel 305 to request the user to input network settings. Here, it is assumed that an input has been made.

In S1505, the CPU 301 requests authentication from the firmware management server 200 and acquires the authentication result. In the following description, it is assumed that the authentication is successful.

In S1506, the CPU 301 specifies the firmware to be downloaded and requests the start of the download.

In S1507, the CPU 301 deletes data in a part of the normal firmware area 520. In addition, the “update-in-progress” flag is set in the firmware update management area 540.

In S1508, the CPU 301 stores the downloaded data, which is part of the latest firmware, in the normal firmware area 520.

In S1509, the CPU 301 determines whether or not the latest firmware has been completely stored. If it is determined that the storing of the latest firmware is not completed (NO), the CPU 301 continues the processing in S1507 and S1508 until the storing of the latest firmware storage is completed. If the storing of the latest firmware storage is completed (YES), the process proceeds to S1510.

In S1510, the CPU 301 deletes the “update-in-progress” flag from the firmware update management area 540 (for example, the flag is changed from the “update-in-progress” state to the “update completed” state (=idling state).

In step S1511, the CPU 301 performs reboot processing to reboot the MFP 300 with the normal firmware.

Firmware Management Server Processing

Details of the control of the firmware management server 200 are described below. FIG. 16 is a flowchart illustrating processing executed by the firmware management server. FIG. 17 is a diagram illustrating a structure of communication data.

This flowchart is implemented by the controller 250 (especially the CPU 201) executing one or more programs.

In S1601, the CPU 201 waits (if NO) until a request is received. When the request is received (YES), the process proceeds to S1602.

In S1602, the CPU 201 determines whether the acquired request is a firmware list acquisition request (corresponding to S1503). In a case where the CPU 201 determines that it is a firmware list acquisition request (YES), the process proceeds to S1603, but in a case where it is determined that it is not a firmware list acquisition request (NO), the process proceeds to S1608. In the firmware list acquisition request, for example, information such as information 1710 in FIG. 17 is exchanged.

In step S1603, the CPU 201 confirms whether or not normal firmware applicable to the model of the MFP 300 is registered in the storage 204. In a case where applicable normal firmware is registered (YES), the CPU 201 advances the process to S1604, but in a case where applicable normal firmware is not registered (NO), the process is ended.

In S1604, the CPU 201 notifies the MFP 300 of the result of the confirmation of the firmware list, and then acquires the serial number from the MFP 300.

In S1605, the CPU 201 confirms whether the obtained serial number is included in the serial number list 1813. In a case where the serial number of the MFP 300 is included in the serial number list 1813 (YES), the process proceeds to S1606, but in a case where the serial number of the MFP 300 is not included in the serial number list 1813 (NO), the process is ended. Information such as information 1720 is exchanged in the authentication request based on the serial number.

In S1606, the CPU 201 transmits the firmware list to the MFP 300 as an authentication report. In the authentication report, information such as information 1730 is exchanged. The information 1730 includes, for example, firmware URI information 1731 and recovery program URI information 1732.

After that, in S1607, a normal firmware download request from the MFP