DE3382744T3 - Microprocessor systems for electronic franking devices. - Google Patents

Description

This invention relates to electronic postage meter systems. EP-A-0 019 515 discloses an electronic postage meter system comprising: an address bus having a plurality of address lines; a data bus having a plurality of control lines; a microprocessor connected to each of the address lines and data lines of the address and data bus and coupled to the control bus; and first and second random access memory units, the microprocessor being directly connected to each of the address and data lines.

An electronic postage meter having an accounting unit with a microprocessor and a non-volatile memory for storing accounting data is disclosed, for example, in U.S. application 089,413 (U.S. Patent 4,301,507). In this system, the accounting data is stored in the random access memory and read from the random access memory via common address and data lines of the microcomputer system. While in most cases it can be assured that the accounting data stored in the memory is correct, there are certain circumstances that can occur which result in undetectable errors in the data.

To overcome such problems, it has been proposed to use redundant memories (EP-A-19 515). The microprocessor program for the franking machine thus includes a subroutine for comparing the data stored in the redundant memories to provide an error indication if the data stored in the two While this technique increases the reliability of the stored data, there are certain circumstances where even this type of redundant system does not allow the determination of a fault. Furthermore, the known system tests various malfunction indicators of the value setting and printing mechanism during printing. Other types of malfunctions are also detected. When a malfunction is detected, an appropriate error code is written to the memory and the franking machine is disabled. It must of course be emphasized that in a franking machine it is essential that the highest degree of reliability of the accounting data is maintained.

An object of the present invention is to provide an electronic postage meter system wherein the possibility of undetectable error conditions is reduced.

According to one aspect of the invention, an electronic franking machine system according to claim 1 is provided.

IBM Technical Disclosure Bulletin Vol. 10, No. 10, March 1968, pages 1484/1485, discloses a fail-safe Memory system with redundant memory units, each of which uses different address and data lines. However, these are only indirectly connected to the CPU via a selection unit.

DE-A-30 24 370 provides for redundant storage, which however are not connected to the same central computer.

According to a further aspect of the invention, an electronic franking machine system according to claim 7 is provided.

For a better understanding of the invention, it will now be disclosed in more detail by way of example with reference to the accompanying drawings, in which:

Fig. 1 is a block diagram of an embodiment of a microprocessor system for an electronic postage meter in accordance with the invention;

Fig. 2 is a timing diagram illustrating the sequence of addressing the redundant memories in accordance with another embodiment of the invention;

Fig. 3 is a timing diagram illustrating another sequence for addressing the redundant memories in accordance with an embodiment of the invention;

Fig. 4 is a block diagram of a portion of a modification of the system of Fig. 1;

Fig. 5 is a block diagram of another modification of a portion of the system of Fig. 1; and

Fig. 6 is a block diagram of another embodiment of the invention.

Referring now to the drawings, and more particularly to Fig. 1, there is shown a microprocessor system which forms an electronic accounting system such as may be used in an electronic postage meter. The system includes a central processing unit 10, such as a microprocessor, and a read-only memory 11 which stores programs for operation of the system. The central processing unit 10 is connected to one or more peripheral devices such as, for example, the printing unit 12 and the control unit 13 of an electronic postage meter such as disclosed in U.S. Patent Application Serial No. 089,413 (Patent No. 4,301,507). In the system of Fig. 1, a secure housing 14 surrounds various components of the system such as the central processing unit 10 and the printing unit 12. As a consequence, it is necessary to provide ports between the central processing unit and the external control unit 13 to enable two-way communication between these units. Preferably these ports are in the form of a pair of one-way transmission paths with opto-couplers 15 and 16 on the secure housing to prevent the application of any electrical potentials to the accounting unit without evidence of attempts to damage the unit. The opto-couplers preferably provide two-way serial communication between the units on a bit-by-bit basis to minimize the number of ports required in the housing.

In addition, as discussed in U.S. Application Serial No. 089,413 (Patent No. 4,301,507), it is desirable to enable communication between the printing unit and the central processing unit 10 by means of a similar pair of optocoupler devices 17 and 18, with these optocouplers preferably enabling two-way transmission on a bit-by-bit basis.

The printing unit, as well as the control unit, can, if desired, have separate microprocessors incorporated therein, allowing the use of a variety of dedicated microprocessor systems. This not only increases the security of the system, but also increases its reliability by limiting the required tasks of each microprocessor to a specific portion of the overall operation of the system. For example, the possibility of a conflicting program request is thereby significantly reduced.

As shown in Fig. 1, a pair of random access memories 20, 21 are also provided in the secure housing. The random access memories 20 and 21 are preferably non-volatile memories of a conventional type so that accounting data can be stored therein without loss. can be stored, although an external power supply for the system may fail. Only, for example, the random access memories of the battery-backed type can be EAROM or EEPROM.

The random access memory 20 is connected to the central processing unit 10 by a plurality of address lines 22 and a plurality of data lines 23. The random access memory is connected to the central processing unit 10 by another plurality of address lines 24 and another plurality of data lines 25. It is necessary that both the address lines and the data lines coupled to the random access memories be different. For example, the address lines A0 to A7 are from a conventional microprocessor system and can be coupled to the random access memory 20, while the address lines C0 to C7 are coupled to the random access memory 21. Similarly, conventional data lines B0 to B3 may be coupled to the random access memory 20, with data lines D4 to D7 being coupled to the random access memory 21.

In an accounting system which requires both security and reliability, it is desirable to provide redundancy. A certain degree of redundancy can be obtained if the random access memories are connected to the central processing facility by means of separate data lines, although they use the same address lines. In such a system, the same data can be read from or written to the two random access memories by means of their respective separate data lines, either simultaneously or at different times, under the control of the respective chip enable signals. While in many cases such an arrangement allows for the detection of errors when comparing data in the two memories, in fact there are possibilities for errors that cannot be detected. For example, if two of the address lines are accidentally shorted, either within the microprocessor itself or external to it, the same incorrect data will be stored in the two random access memories, so that a comparison of the data stored in the two memories will not reveal an error condition.

This problem is overcome by using a completely different set of address lines of the address bus to address the two random access memories. Preferably, of course, the number of address lines and the number of data lines connected to the random access memories are the same. Now, if two address lines of the system are shorted, for example, the probability is small that the resulting data stored in the two memories will be the same, so the reliability of the system in detecting errors is significantly increased.

While the two random access memories can be addressed simultaneously, using their separate address lines, to store or read the same information, this can also result in errors that are not detectable or correctable. For example, it is possible that a transient signal on the bus lines can affect the data being transferred simultaneously in the same way. Accordingly, as shown in Fig. 2, the two memories are addressed with respect to the same data in a sequential manner. For example, all sequential bytes of a message are first given to or received from the first memory, ie, memory 1. The transmission of this message with respect to the first Following the first memory, the same message is then transmitted with respect to the second memory. It is of course clear that the term "byte" here refers to data with a length equal to the number of data lines connected to each memory.

To reduce the time required to update or read the memory, each memory can be updated or read simultaneously, but with different data transferred to or from each memory at each moment, as shown in Fig. 3.

Figs. 2 and 3 thus illustrate two techniques for minimizing the occurrence of undetectable errors resulting from the occurrence of, for example, transient pulses. It is clear that the same effects would be unlikely to occur with sequentially transmitted data.

In yet another embodiment of the invention, the data in the two memories may be stored in different forms. For example, the data stored in one or both of the memories may be encoded to minimize the occurrence of errors undetectable by comparing the data stored in the two memories. For example, as shown in Figure 4, an encoder/decoder 30 may be used to encode and decode the data stored in the random access memory 20 that is applied to and received from the data bus 23. An encoder/decoder 31 may optionally be provided for encoding and decoding data in the random access memory 21. If such an additional encoder/decoder is used, it is preferable that it have a different encoding than that of the encoder/decoder 30.

It will of course be understood that the microprocessor programs will have appropriate subroutines to determine which memory is more likely to be correct in the event that a comparison between the data reveals an inconsistency. In addition, further routines may be provided in the event that the system is unable to determine which of the data entries are error-free, to provide an error indication which will prevent further operation of the system.

In the embodiment of the invention shown in Figs. 2 and 3, the two memories are addressed under the control of a fixed program which, for example, responds to a predetermined condition in the system. As a consequence, there necessarily exists a predetermined relationship between the addressing times for the two memories. As a further modification, if separate memory units are provided, each memory unit can be made to respond independently to predetermined conditions. For example, if the accounting system is connected as shown in Fig. 1 to form a postage meter, the two memories can respond independently to any printer setting feedback signal to update the separate memories, with a higher-level subroutine provided for mutual checking, i.e. comparing the data stored in the two memories. The independent control can, for example, be in the form of a memory controller. By thus making the two memory units operate more independently of each other, the chance of error-free operation is greatly increased.

In order to ensure proper operation and thereby preserve the entirety of the accounting information stored therein, electronic franking machines are equipped with a plurality of sensors, such as sensors 50, 51 and 52, which are connected to the central processing unit 10 in Fig. 1. These sensors can be used to check a variety of conditions in the franking machine, such as the position of a locking bar which blocks operation of the franking machine, the positions of various intermediate devices which control operation of the franking machine, and various other condition sensors such as temperature and humidity. In non-electronic franking machines of the type which uses microprocessors for control, such as disclosed in US 3,978,457, certain of these sensors are interrogated by means of a software routine after power is first applied to the franking machine. The positions of the various locking bars and intermediate devices are also determined by means of software routines which are initiated by means of various external conditions, such as, for example, manually controlled operations for initiating the printing of postage. The error checking routines for checking such sensors, as well as for checking additional conditions such as the correctness of data stored in the memories, are thus only called when specifically requested in response to an external stimulus. Thus, although a condition may have occurred between operations of the meter which at some point causes it to cease operation (ie, the next time it is called upon to print postage), the meter may still appear deceptively operational.

In accordance with a further feature of the invention, a program for the microprocessor causes the random access memory registers, as well as the various sensors, which may be optical switches, and any other critical data indicators to be checked at regular intervals during operation of the franking machine, rather than simply checking these parameters when the franking machine is started up and without external stimulation. Thereby, By making periodic checks, the probability of error-free operation is further increased. In other words, the main routine of the franking machine, to which it always returns after completion of, for example, a postage printing operation, includes software subroutines that periodically check critical parameters, such as the correct positioning of mechanical elements in the franking machine and the correct comparison of data in memories, as well as the correctness of the data in accordance with checksum data. This technique allows for the additional, advantageous, periodic testing of other mounted sensors, for example to detect mechanical breaches of the security of the housing.

For this purpose, as shown in Fig. 5, the sensors 50, 51 and 52 may be connected to set a plurality of stages of a shift register 55. It will of course be appreciated that the number of such sensors may be greater than the three shown. The shift register 55 is coupled to the address and is read out by the central processing unit 10 at predetermined times in the main program. An encoded bit pattern is provided in the read-only memory 11 corresponding to the correct, error-free conditions of the sensor. At times during the program when the sensors are to be tested, the shift register, under control of the central processing unit, shifts out the existing bit pattern for comparison with the bit pattern stored in the read-only memory 11. This allows the status of the various sensors in the franking machine to be continuously determined so that the franking machine can be locked as soon as a condition occurs that violates the integrity of the franking machine.

The shift register can, of course, be shifted under control of the microprocessor using the system's conventional clock source. Alternatively, the shift register can be pre-programmed in accordance with a certain unique pattern so that the output of the shift register can be compared to a predetermined "OK" condition. The information available from an 8 or 16 bit pattern code according to this embodiment of the invention can thus provide a very high degree of sophistication for determining any suitable error check for diagnostic purposes using signature analysis techniques. This form of error checking can impose various system constraints, both for diagnostics and possible error correction on an automatic basis.

In the system illustrated in Figure 1, as discussed above, the printing unit 12 and control unit 13 may include special microprocessors for controlling the specific functions of those units, thereby enabling the use of a special system for the accounting unit including the central processing unit 10, the read-only memory 11 and the random access memories 20 and 21. In further embodiments of the invention, the printing unit 12 may further include a random access memory 60 and/or the control unit 13 may include a non-volatile random access memory 61.

In a further embodiment of the invention, as shown in Fig. 6, the non-volatile random access memories 20, 21 of the accounting system are coupled to separate microprocessors 60, 61, each of the microprocessors having a separate read-only memory 62 or 63 for storing the operating programs for the respective microprocessor. It is of course understood that The arrangement shown in Fig. 6, as well as the arrangement of Fig. 1, shows that the read-only memory, as well as other components of the system, can be incorporated into the same integrated circuit as the microprocessor.

Because the two microprocessors are separately controlled, and have separate address and data lines 64 and 65, respectively, the two random access memories are thereby controlled entirely independently. The two microprocessors communicate separately with the controller 13 and the printer 82 by means of separate selector switches 70 and 71, which are addressed by the respective microprocessors 60 and 61. As a consequence, each of the microprocessors can receive signals from the printer and the controller, and each of them can also transmit messages. In addition, data processed in the two microprocessors can be compared by means of a data latch 72, which is controllable by either of the microprocessors.

In the arrangement of Fig. 6, input data received from, for example, the keyboard 73 or other peripheral device coupled to the control unit 13 is applied to the two microprocessor systems by means of the optocouplers 15 and 15 and the selector switches 70 and 71. Alternatively, of course, the data can be input to the two microprocessors in response to an interrupt signal. The two microprocessors, in response to the input information, carry out the necessary accounting procedures independently of one another with respect to the data stored in the respective random access memories. The programs of the two microprocessors enable an exchange of accounting data for comparison, for example on a contention basis, by means of the data locking memory 72. The programs of the two microprocessors can, for example, activate only one of the microprocessors connected to the control unit coupled display 75, and/or to control printer 82. Alternatively, of course, redundant control may be used, whereby control of a printer function or control of a display may require the joint occurrence of the output function from the two microprocessors. This may be accomplished, for example, in the manner disclosed in U.S. application Serial No. 089,413, filed October 30, 1979, commonly assigned to the present application, by controlling a pair of series transistors separately by the two microprocessors, whereby the joint output of the series transistors provides the desired control. It will of course be understood that other techniques may be used for this purpose.

The arrangement of Fig. 6 thereby increases the redundancy of the system so that even a failure in a microprocessor enables the determination with great reliability of the occurrence of an error condition which may require the locking of the franking machine.

In the system of Fig. 6, the printer unit is shown as fully comprising a microprocessor 80 coupled to the optocouplers 17 and 18 and controlling a pressure adjuster 81. The pressure adjuster 81 adjusts the print wheels in a printer 82, the adjustment of the print wheels being fed back to the microprocessor 80 by means of a feedback path 83. This feedback enables the printer unit to determine if an error has occurred in the adjustment of the print wheels and thereby to disable the postage meter in the event of an incorrect adjustment. The feedback adjustment can be applied by the microprocessor 80 to the optocouplers 17 and 18, thereby enabling the two microprocessors in the accounting system to respond separately to the feedback signals to account for postage to be printed.

It will of course be understood that appropriate control lines are provided, connected to the microprocessor and the random access memory in the usual manner, to control the system.

The function of locking the franking machine can be achieved in the illustrated embodiments by preventing the operation of the mechanical elements of the franking machine under program control. Alternatively, the presence of an error requiring locking of the franking machine can instruct the microprocessor routines to perform an endless loop. Errors that do not require locking of the franking machine can be displayed under the control of the microprocessor by means of the display 73, which is coupled to the external control unit.

Thus, in accordance with one aspect of the invention, redundant non-volatile memories are provided in the accounting unit of an electronic postage meter, the accounting unit having a microprocessor controlled to store accounting data redundantly in the two memories. To minimize the possibility of undetectable errors, the two redundant memories are connected to the microprocessor, i.e. the microcomputer bus, by entirely separate sets of data and address lines. As a result of the complete separation of addressing and data, various error conditions, such as shorting a pair of address lines, do not result in erroneous addressing of both memories. Accordingly, under such circumstances, shorting a pair of address lines does not result in the storage of the same data in both memories, so that a comparison of the stored data results in the detection of the error condition.

In accordance with another embodiment of the invention, corresponding data is redundantly applied to the redundant memories at different times. This can be accomplished by separately applying the data sequentially to the two memories. Alternatively, data can be applied to or read from the two memories simultaneously, with the data transmitted at any one time with respect to the two memories corresponding to different information. As a result, momentarily occurring transients on the transmission lines are unlikely to affect the corresponding data stored in the two memories in the same way. Therefore, this system thereby minimizes the possibility of undetectable or uncorrectable errors resulting from transients.

In accordance with yet another embodiment of the invention, the redundancy of the accounting system can be increased by also using redundant microprocessors to control the two memories.

To further minimize the possibility of printing postage without accounting, the microprocessor program may be directed to periodically testing various critical parameters in the microprocessor as part of a main routine, with the test routine only interrupted if necessary during a conventional postage printing operation, such as printing postage and accounting for it. As a consequence, the routine allows the postage meter to continually test such parameters so that the postage meter can be disabled as soon as a condition exists which threatens the integrity of the accounting data. Error checking on a periodic basis may not only test the physical parameters, such as positions of various mechanical elements, but can also effect the comparison of the data stored in the two memories, as well as the performance of checksum tests to determine whether the data stored in each memory conforms to predetermined relationships.

Other types of memory can of course be used instead of RAM, for example serial memory.

While the invention has been disclosed and described with reference to a limited number of embodiments, it will be understood that variations and modifications may be made therein within the scope of the following claims.

Claims (10)

1. Electronic franking machine system with an address bus (22, 24) having a plurality of address lines; a data bus (23, 25) with a plurality of data lines; a control bus with a multitude of control lines; a microprocessor (10) directly connected to each of the address lines and data lines of the address and data bus and coupled to the control bus; and first and second random access memory units (20, 21), characterized in that each memory is connected to different lines of the address bus and different lines of the data bus, so that the memories can be addressed separately with random access. 2. System according to claim 1, characterized by a program memory (11) for controlling the operation of the microprocessor (10) and a program for addressing the first and second random access memory units (20, 21) to store the same data therein. 3. System according to claim 2, characterized in that the program addresses correspond to storage locations of the first and second memory units (20, 21), whereby corresponding data are stored therein or read therefrom at different times. 4. System according to claim 2 or 3, characterized in that the program simultaneously stores different data in the first and second storage units (20, 21) at non-corresponding address locations, whereby momentarily occurring errors affect the data stored in the first and second storage units in different ways. 5. System according to one of claims 1 to 4, characterized by means responsive to differences in data stored in first and second memory units (20, 21) to inhibit further operation of the microprocessor (10). 6. System according to one of claims 1 to 5, characterized in that the random access memory units (20, 21) are non-volatile. 7. Electronic franking machine system with a microprocessor (10), addressable and redundant non-volatile memory devices (20, 21), the non-volatile memory devices having two separate non-volatile memory units (20, 21), a control bus with a plurality of control lines coupled to the microprocessor, an address bus device (22, 24) which is connected to the non-volatile memory devices and the microprocessor (10), and a data bus device (23, 25) which is connected to the non-volatile memory devices (20, 21) and the microprocessor (10), each memory unit being connected to different lines of the address bus and to different lines of the data bus so that random access memory units can be separately addressed, the microprocessor (10) being programmable to generate data for sequential writing to the non-volatile memory means (20, 21) and to read data from the non-volatile memory means (20, 21) so that the data is redundantly written to respective ones of the memory units; and means are provided for causing the data to be stored in the respective non-volatile memory units (20, 21) in different forms. 8. Electronic franking machine system according to claim 7, characterized in that the means for causing the data to be stored in different forms comprises an encoder-decoder (30, 31) for receiving the data and encoding the data before the data is written into a first of the non-volatile memory units, and for decoding the data after reading the data from the first non-volatile memory unit. 9. Electronic franking machine system according to claim 7, characterized in that the means for causing the data to be stored in different forms comprises: a first encoding-decoding device (30) for receiving the data and encoding the data before the data is written into a first one of the non-volatile memory devices (20) and for decoding the data after reading the data from the first non-volatile memory unit; a second coding-decoding device (31) for receiving the data and coding the data before the data is written into a second (21) of the non-volatile memory units, and for decoding the data after reading the data from the second non-volatile memory unit. 10. Electronic franking machine system according to one of claims 6 to 9, characterized in that the volatile memory units are of the battery-assisted type EAROM or EEPROM.