EP0516403B1

EP0516403B1 - Method of remote diagnostics for franking machines

Info

Publication number: EP0516403B1
Application number: EP19920304809
Authority: EP
Inventors: Cyrus Abumehdi
Original assignee: Neopost Ltd
Current assignee: Neopost Ltd
Priority date: 1991-05-29
Filing date: 1992-05-28
Publication date: 1997-08-13
Anticipated expiration: 2012-05-28
Also published as: GB2256396A; GB9111490D0; GB2256396B; EP0516403A2; EP0516403A3; DE69221538D1; DE69221538T2

Description

This invention relates to remotely diagnosing faults which may occur in franking machines.
Franking machines in use in the field may develop faults at indeterminate periods. Some faults may be insignificant and merely prevent use of certain facilities normally provided by the machine or may be intermittent and affect use of the franking machine at indeterminate times. Other more serious faults may occur which result in inhibition of use of the machine for franking of mail items. The latter more serious faults cause significant inconvenience to the user of the machine because the machine is not available for use in franking mail. It is desirable to reduce or prevent the occurrence of faults in machines in order to ensure that generally the machines are always available for use when required. By maintaining a fault history of each machine in the field it is possible from analysis of the fault history of any individual machine to predict and provide an early warning of the possible occurrence of a specific fault. From this predictive information action may be taken to service or modify the franking machine prior to the occurrence of the predicted fault and thereby prevent loss of use of the machine.
GB-A-2 178 880 discloses a postage meter inspection system in which the postage meter is provided with sensors responsive to attempts to tamper with the postage meter, i.e. attempts to obtain fraudulently postage charges for mail items. The sensors are interrogated and indications of tampering attempts are communicated to a central location either electronically or by mailing imprinted postcards.
According to one aspect of the invention a method of remotely obtaining data from a franking machine in which data is stored in a memory of the franking machine; the franking machine is periodically placed in communication with a remote central computer and during said communication data is read from the memory and transmitted to the remote central computer characterised in that a fault code identifying a fault occurring during normal operation of the franking machine in franking mail items is stored in the memory upon occurrence of the fault to form a fault history of the franking machine; in that during each communication between the franking machine and the remote central computer for remote recrediting of the franking machine the fault history stored in the memory automatically is read out and transmitted to the remote re-crediting computer and is written to a fault history store; and further characterised by analysing said fault history stored in the fault history store to provide an indication of impending faults.
According to another aspect of the invention a franking machine system including a plurality of franking machines; each franking machine including accounting registers for storing accounting data; communication means to transmit data between a remote central resetting computer and each of said franking machines; each said franking machine being operable to be remotely recredited by said remote central resetting computer characterised in that each franking machine includes a fault history memory and means operative upon occurrence of a fault in said franking machine during normal operation of the franking machine in franking mail items to write into said fault history memory a fault code representing the fault which has occurred so that the memory stores a fault history comprising a series of faults codes representing a series of occurred faults; in that during each recrediting of each franking machine, the franking machine being recredited is operative automatically to read out the fault history from the fault history memory and transmit the fault history to the remote central resetting computer; in that the remote central resetting computer includes a fault storage memory to store the fault histories transmitted from the respective franking machines; and further characterised by a fault analysis computer operable periodically to communicate with said remote central re-setting computer to read out the fault histories stored in said fault storage means relating to said franking machines; to analyse said fault histories and to generate for each said franking machine an indication of impending faults.
The method in accordance with the invention will now be described by way of example with reference to the drawings in which:-

Figure 1 is a block diagram illustrating franking machines connected for communication with a remote resetting centre and service centre, and
Figure 2 is a flow chart of a sequences of events in remote fault diagnosis and remedial action in respect of a franking machine.

Referring first to Figure 1, a franking machine 10₁ comprises an electronic microprocessor 11 for carrying out control and accounting functions in the franking machine. A keyboard 12 is provided for input of data by a user of the machine and a display device 13 is provided to enable the microprocessor to display information to assist the user in using the franking machine. A read-only memory (ROM) 14 is provided for the storage of fixed information such as program routines for controlling operation of the microprocessor 11 and a random access memory 15 is provided as a working store for the microprocessor. Non-volatile memories 16, 17 are provided for the storage of accounting data and as is well known in franking machines may include a descending register for storing a value of credit available for use in franking of mail items with postage value, a tote register for storing an accumulated value of postage used in franking mail items, an items register storing a count of the number of items franked and a high items register for storing a count of the number of items franked with a postage value in excess of a predetermined value. A printing device 18 is controlled by the microprocessor to print franking impressions on mail items. In franking machines which operate in a prepayment mode, the user of the machine makes a payment to the postal authority and the value of the payment is entered into the descending register of the franking machine to provide an amount of credit available for use in franking mail items with postage value. The read-only memory 14 stores a program routine for controlling the microprocessor in carrying out franking operations. In such franking operations, the user of the machine inputs by means of the keyboard 12 a value of postage with which a mail item is to be franked and the microprocessor checks to determine that there is a sufficient value of credit in the descending register for required franking. If there is sufficient credit the microprocessor continues with the program routine to modify the contents of the registers to take account of the franking being effected and to operate the printing device to print a franking impression with the required postage value on the mail item. If there is insufficient credit available the franking routine is terminated and printing of the franking impression is not effected. The franking machine remains incapable of carrying out further franking operations until such time as additional credit has been entered into the descending register.
As is well known in franking machines those operational parts of the machine which maintain accounting records and which effect printing of the franking impression are protected from attempts to fraudulently interfere with the operation thereof. To this end the operational parts of the machine are housed in a secure housing access to which may be made only by authorised personnel of the postal authority or of an authorised service organisation and any external electrical connections to the machine are protected to prevent external application of unauthorised signals in an attempt to use the machine fraudulently. The accounting operations and storing of the accounting records are carried out in a manner to ensure integrity of the accounting data even in the event of the occurrence of faults in the machine. For example, each register is duplicated in each of the non-volatile memory devices 16, 17 so that if one device should fail, the registers in the other device will continue to store the accounting data.
The franking machine is provided with an input/output interface 19 communicating with the microprocessor to enable the microprocessor to communicate with apparatus external to the franking machine.
Previously, when the credit value in the descending register had fallen to a low value it was necessary for the postage meter of the franking machine to be taken to a resetting authority such as the postal authority to have an increased value of credit entered into the descending register. However current postage meters are constructed to have provision to enable increased credit to be entered remotely without removing the postage meter from the user's premises. A system for re-setting credit in a franking machine remotely by means of a re-crediting computer 20 is described in our European patent application 89313220.9 (EP-A-0 376 573). Communication is established between the microprocessor of the franking machine and a re-crediting authority computer 20 via the interface 19 and a telephone network 21. The microprocessor 11 and the computer 20 carry out a series of steps in which credit update information is transmitted from the computer to the franking machine and in which the franking machine sends accounting data from its registers to the computer. Security in transmission of the information over open telephone lines is maintained by transmitting a transaction identity code comprising a pseudo-random number in messages between the computer and franking machine and by encrypting the messages.
During operation of franking machines faults may occur which in themselves do not prevent operation of the machine for franking purposes but which may provide an indication that a more serious fault condition preventing use of the machine has a probability of occurring in the future. Accordingly it is desirable to log faults as they occur in each machine to provide a fault history for each individual franking machine and to analyse these faults to determine if from experience any of the machines in use in the field have a fault history which suggests that they are likely to fail in operation. The franking machine 10₁ is provided with a fault register 22 having a number "n" of storage locations. Upon occurrence of a fault, the microprocessor writes a code representing the type of fault which has occurred into a storage location of the fault register, the codes being written into the storage locations in turn. Thus at any time, the register stores a log of the most recent "n" faults which have occurred. The program routine carried out by the franking machine during re-setting of credit includes a sub-routine in which the contents of all the storage locations of the fault register 22 are read out and transmitted to the re-crediting authority computer 20. The storage locations of the fault register are erased so that after read out, the register is ready to receive the code representing the next fault when it occurs. Instead of erasing the storage locations of the fault register, the storage locations may be overwritten in turn in such a manner that when the code for each new fault is written to the register the code for the oldest fault is overwritten. Accordingly the codes stored in the register always represent the most recent "n" faults which have occurred. The re-crediting authority computer is provided with memory 23 and when the computer receives the log of fault codes from a franking machine in the course of re-setting credit in that franking machine, the computer writes the log of fault codes into its the memory 23. It will be appreciated that a large number of franking machines 10₁ - 10_n are re-credited as and when required by a single central re-crediting computer. Accordingly the log of fault codes is stored in the memory together with information identifying the meter from which the log has been received. Thus over a period of time, the computer 20 will receive and store in memory 23 the fault logs or histories of all those machines 10₁ - 10_n which have had credit updated during that period. It will be appreciated that this transmission of fault data occurs automatically each time a franking machine is re-credited and hence as result does not require communication with the franking machine specifically for the purpose of transmitting fault data. Accordingly the user of the machine is not required to carry out any additional operation and the accumulation and transmission of fault data is transparent to the user. Furthermore by transmitting the fault log data as part of the re-crediting routine, the data is transmitted and collected at the computer memory 23 at a periodicity which corresponds to some extent upon the amount of use of each franking machine. In Figure 1, the fault register 22 is shown as a separate element however if desired the fault register may be implemented as a register in the non-volatile memories 16, 17 and like the accounting registers in these memories may be duplicated in each of the memories 16 and 17.
Servicing and correcting faults in franking machines is carried out by an authorised service organisation. The service organisation is provided with a computer 24 which is capable of communicating with the re-crediting authority computer 20 and is permitted to have access to the fault log data in memory 23. Periodically the computer 24 accesses the fault log in memory 23 and an analysis of the faults which have occurred on the franking machines is carried out. Such an analysis may predict that a specific franking machine is likely to develop a specific fault and in accordance with that prediction a service engineer visits the site of the franking machine to carry out modification or repair of the machine to prevent occurrence of the predicted fault. The analysis alternatively may predict that a specific batch of machines is prone to one or more specific faults in which event action may be taken to modify all machines in that batch to prevent occurrence of that fault in those machines of the batch which are not yet affected.
Where the re-crediting of franking machines is carried out by means of transportable memory modules as in the CREDIPAC re-crediting system marketed by Alcatel Business Systems Limited, the transportable modules may be utilised to convey fault log data from the franking machine to the computer 20 instead of utilising the telephone network. For a more detailed description of the operation of re-crediting utilising a transportable memory module reference may be made to the specification of our British patent No. 2173738.
As hereinbefore described, transmission of the fault log data from the franking machine is effected each time the franking machine is re-credited. However transmission of the fault log data may be effected as part of another routine which occurs periodically for each machine. For example, franking machines which are operated in a post payment mode do not carry out re-crediting operations. However periodically the postal authority require to receive data relating to usage of the machines and for this purpose receive the values stored in the accounting data registers to enable the authority to audit usage of the machines. Where the data relating to usage of the machines collected remotely by transmission of the data either by means of the telephone network or for example by means of a transportable module the transmission of fault log data may be effected as a sub-routine of the main routine for collection of account data.
The flow chart of Figure 2 illustrates the steps carried out in each of the franking machines 10₁ - 10_n, the central re-crediting computer 20 and the service computer 24 to provide fault histories of each machine, to transmit these fault histories to the service computer and to modify or repair the machines in dependence upon analysis of the fault histories.
Analysis of the fault log of a specific franking machine may indicate that there is a probability of failure of a component of that machine which would result in the machine becoming inoperable to effect franking of mail items and hence require an on-site visit by a service engineer to effect an early repair or replacement of that component to ensure that the machine continues to operate satisfactorily and remains in service. However the analysis of the fault log may indicate a fault history which does not require physical replacement or repair of a component. For example fault may arise from software program routines or sub-routines particularly under certain conditions of use of the machine in which there is interaction between sub-routines which had not been envisaged when the software was written or installed in the machine. Such faults may also arise due to change in tolerances of electronic components such that they are required by a software routine to operate close to a current tolerance limit. A modification of the software routine may be made which has the effect of operating the component safely within its current tolerance. In response to such faults being registered in any of the franking machines, transmitted to the re-credit computer 20, and written to the memory 23 and then being transferred to the service computer for analysis, the software may be modified to overcome any tendency for the detected fault to occur. Instead of installing the modified software by on-site visists of a service engineer, the service computer 24 may communicate via the telephone network 21 with a selected one of the franking machines 10₁ - 10_n to enable the modified software code to be transmitted to the franking machines from the service computer via the telephone network. The modified software code may be transmitted to all franking machines of a specified model number in the field or only to those franking machines which, from analysis of their fault histories, indicate a need for modification of the software. Acess to the memories in the franking machines which store software code must be restricted to prevent unauthorised modification of the software and accordingly any transmission from the service computer to the franking machines for the purpose of modifying or writing new software routines into the memories of the franking machines includes signals which enable access to the software code memories to be obtained. Such transmissions are carried out in a secure manner to ensure that only authorised transmissions enable access to the software code memories and that only the software code transmitted in an authorised transmission is written to the memories of the franking machines. A method of securely transmitting data over a telephone network for the purpose of re-crediting a franking machine is described in our European patent application 89313220.9 referred to hereinbefore. A similar secure method of transmitting data may be used for transmission of signals to modify operation of the franking machine. Where re-crediting is effected by means of a transportable memory module as described in our British patent No. 2173738 and referred to hereinbefore modification of software code in a franking machine may be effected by utilising the transportable memory module to carry the modified software code to be written into the memory of the franking machine. Our British patent describes a method of ensuring security of the data carried by the module and such a method may be utilised to ensure security of signals carried by the module to be utilised to modify operation of the franking machine.
The modification of software may include re-configuration of variables capable of being set in the franking machine software program routine. The software memories of the franking machine may be loaded with a number of sub-routines in manufacture of the franking machine. Some of these sub-routines may be activated upon installation of the franking machine while others of these sub-routines are left in-activated. During use of the franking machine in the field it may be desired to de-activate or activate selected ones of these co-resident sub-routines either to modify the facilities provided by the franking machine or in order to overcome the probability of a fault arising as indicated by the analysis of the fault history of that machine.
When faults occur in the franking machine, fault flags are set to indicate the occurence of the fault. Some faults may arise due to a delected error in data stored in the franking machine. Electronic accounting data is handled by the circuits of the franking machine in a manner such that, except in the event of catastrophic failure, the data can be re-constructed. For example each register which stores accounting data is replicated four times and in each operation of the franking machine involving the accounting data the contents of the four replications of the registers are compared. If the contents are identical continued operation of the franking machine is permitted. However if the contents of three replications of the register are the same but one register is different a fault flag is set to inhibit continued operation of the machine. Since the contents of three replications of the register are identical it is clear that these replications contain correct data. Accordingly a sub-routine can be activated to correct the data in that one of the replications which is different from the other three replications and to reset the fault flag. This sub-routine may be activated remotely by the service computer using a secure transmission and then the fault flag may be reset remotely by a secure transmission. If the data has been corrected the fault flag can be reset. Other faults may occur which do not involve electronic data. If the fault is transitory or intermittent a transmission to reset the fault flag will be successful in resetting the fault flag. However where a permanent or non-transitory fault exists the reset of the fault flag will fail. Many faults are transitory or intermittent and hence the remote resetting of the fault flag allows the franking machine to be continued to be used until a service repair can be effected.
In Figure 1, the service computer 24 is shown as communicating with the re-credit computer by means of a dedicated communication link 25. However it is to be understood that the service computer may communicate with the re-credit computer via the telephone network 21.

Claims

A method of remotely obtaining data from a franking machine in which data is stored in a memory (22) of the franking machine (10₁) ; the franking machine is periodically placed in communication with a remote central computer (20) and during said communication data is read from the memory (22) and transmitted to the remote central computer (20) characterised in that a fault code identifying a fault occurring during normal operation of the franking machine (10₁) in franking mail items is stored in the memory (22) upon occurrence of the fault to form a fault history of the franking machine; in that during each communication between the franking machine and the remote central computer (20) for remote recrediting of the franking machine the fault history stored in the memory (22) automatically is read out and transmitted to the remote re-crediting computer and is written to a fault history store (23); and further characterised by analysing said fault history stored in the fault history store (23) to provide an indication of impending faults.
A method as claimed in claim 1 further characterised by the step of storing at the remote central computer (20) the fault history received from each of a plurality of franking machines (10₁-10_n) during each recrediting of the respective franking machines by the remote central computer (20).
A method as claimed in claim 2 including the step of periodically accessing the fault histories stored by the remote central computer (20) and transmitting said fault histories to a fault analysis computer (24).
A method as claimed claim 2 or 3 further characterised in that the fault history is transmitted from the franking machine (10₁-10_n) to the remote central computer (20) via an input/output interface (19) of the franking machine and a telephone network (21).
A method as claimed in claim 2 or 3 further characterised in that the fault history is transmitted from the franking machine to the remote central computer (20) by connecting a transportable memory module to the franking machine and writing said fault history into the transportable memory module; connecting said module to the remote central computer (20) and reading the fault history from the module to the computer.
A method as claimed in any one of claims 2 to 5 further characterised by the steps in response to the analysis of the fault history stored in the fault history store of establishing communication between the remote central computer and a selected one of the franking machines (10₁-10_n) and by said communication effecting modification of operation of said selected franking machine.
A method as claimed in claim 6 further characterised in that during the communication established with the selected one of the franking machines (10₁-10_n) the remote central computer transmits a signal to the selected franking machine effective to modify a program routine or sub-routine in said selected franking machine.
A method as claimed in claim 6 further characterised in that the modification of the program routine comprises activating or de-activating program sub-routines which are co-resident in the selected franking machine.
A method as claimed in claim 6, 7 or 8 further characterised by the step of transmitting from the central computer a reset signal to the selected franking machine effective to reset a fault flag in said selected franking machine.
A method as claimed in any one of claims 6 to 9 further characterised in that the transmission of signals to modify operation of a selected franking machine is effected in a secure manner.
A franking machine system including a plurality of franking machines (10₁-10_n) ; each franking machine including accounting registers (16, 17) for storing accounting data; communication means (21) to transmit data between a remote central resetting computer and each of said franking machines; each said franking machine being operable to be remotely recredited by said remote central resetting computer characterised in that each franking machine includes a fault history memory (22) and means (11) operative upon occurrence of a fault in said franking machine during normal operation of the franking machine in franking mail items to write into said fault history memory (22) a fault code representing the fault which has occurred so that the memory (22) stores a fault history comprising a series of faults codes representing a series of occurred faults; in that during each recrediting of each franking machine, the franking machine being recredited is operative automatically to read out the fault history from the fault history memory (22) and transmit the fault history to the remote central resetting computer; in that the remote central resetting computer includes a fault storage memory to store the fault histories transmitted from the respective franking machines; and further characterised by a fault analysis computer (24) operable periodically to communicate with said remote central re-setting computer (20) to read out the fault histories stored in said fault storage means (23) relating to said franking machines; to analyse said fault histories and to generate for each said franking machine an indication of impending faults.