Conventionally, for upgrading software used in a control apparatus, new version of the software is downloaded from a management apparatus via network.
When the software to be upgraded is an application program such as software for spreadsheets or word processor, system booting failure will not occur even if write error or power failure occurs and the upgrade fails. However, in the case that the software to be upgraded is a kind of basic software which is involved in system booting, should abnormality occur during download or update, system booting failure may occur.
Therefore, various technologies have been suggested in order to avoid system booting failure even if any abnormality occurs during downloading and upgrade fails (e.g., see JP 2001-117780 and JP 5-158703).
The prior art control unit disclosed in JP '780 includes a first and a second flash PROMs, one of which stores software used for current system booting. The system also includes a manual switch which can assume a first and second statuses, and a switching unit to assign one of the first and second flash PROMs to a predefined address space for read/write software, based on the status of the manual switch and a upgrade signal indicating whether upgrade is currently carried out or not (level “1” at the time of upgrade, otherwise, level “0”), to enable read and write the software. In the case that the manual switch is in the first status, the switching unit assigns the first flash PROM to the predefined address space if the upgrade signal is at level “0”, and the switching unit assigns the second flash PROM to the predefined address space if the upgrade signal is at level “1”. In another case that the manual switch is in the second status, the switching unit assigns the second flash PROM to the predefined address space if the upgrade signal is at level “0”, and the switching unit assigns the first flash PROM to the predefined address space if the upgrade signal is at level “1”.
In a prior art control unit having above structure, software is upgraded as follows. Suppose that the first flash PROM stores software currently used for system booting, and the manual switch is in the first status. When the software stored in the first flash PROM is to be upgraded, the version up signal is changed to “1” to download the upgraded software. In this case, since the manual switch is in the first status and the upgrade signal is “1”, the second flash PROM is addressed to predefined address space and the upgraded software is downloaded and written in the second flash PROM. After upgrade is completed, the upgrade signal is changed to “0” and the predefined address space is assigned to the first flash PROM.
The prior art control apparatus disclosed in JP '703 includes EEPROM for current use and auxiliary EEPROM, and EEPROM for current use stores the software currently used for system booting. The control unit further includes a toggle-type register which can assume two statuses, that is, ON/OFF to indicate whether the system is booted using EEPROM for current use or auxiliary EEPROM on reset. When the toggle-type register is ON, EEPROM for current use is used for system booting, and when the toggle-type register is OFF, auxiliary EEPROM is used for system booting.
In the prior art control unit having a structure as above, software is upgraded as follows. Suppose that the toggle register is ON and the control unit is run by the software stored in EEPROM for current use. In this configuration, when the software stored in EEPROM for current use is to be upgraded, the upgraded software is transferred from the management apparatus to the control unit, and auxiliary EEPROM is designated as a place to store the transferred software. Thereby, the control unit writes the upgraded software transferred from the management apparatus to auxiliary EEPROM. Then, the control unit verifies whether the data in auxiliary EEPROM is normal or not according to an instruction from the management apparatus, and returns the verification result to the management apparatus. If the verification result indicates some problem, the management apparatus transfers the upgraded software again. Otherwise if no problem, the management apparatus toggles the toggle-type register to OFF and instructs the control unit to perform a reset. Thereby, the control unit will be reset and the boot program starts. In this case, since the toggle-type register is turned OFF, the control unit starts the system using the upgraded software stored in auxiliary EEPROM.
In the prior art technologies disclosed in JP '780 and JP '703, the upgraded software is downloaded to a storage device (flash PROM, EEPROM) other than that stores the software being currently used for system booting. Thus, when the upgrade fails, the system can be booted using the old version software stored in this storage device, so that system booting failure will not occur.
However, in view of the technologies disclosed in JP '780 or JP '703, it remains desirable to solve following problems.
According to the technology disclosed in JP '780, the user must toggle a manual switch to use the upgraded software after downloading. This method is inconvenient for users in operation. Particularly, in the technology disclosed in JP '780, when upgrading the software, the second flash PROM is designated as the predefined address space to read and write software, by the switching unit. After upgrading, the first flash PROM which stores the old version software is designated as the predefined address space by the switching unit. Therefore, in order to use the upgraded software, the user must toggle the manual switch to designate the second flash PROM to the predefined address space. This configuration is not convenient for users in operation.
On the other hand, according to the technology disclosed in JP '703, the upgraded software is downloaded to auxiliary EEPROM. Then, the system is reset, and booted using the upgraded software. This configuration does not have an inconvenience like the technology disclosed in '780 for users because the user does not have to operate the manual switch in order to use the upgraded software.
However, in the technology disclosed in JP '703, it may take a long time to boot the system because in the case if any problem is detected in the verification, the management apparatus downloads the data of the upgraded software again into auxiliary EEPROM. This process may take a long time and cause some delay to complete booting the system. Particularly, in the case that the size of the software to be upgraded is large, much time should be spent until start of system booting. This causes problems such as operations using the control unit cannot be started in time, or interrupted for a long time.