EP0718800A1 - Franking machine with a spare memory - Google Patents

Abstract

The electronic control (10) accesses two battery-backed nonvolatile stores (26, 28) and a ferroelectric reserve store (30) all operating according to different technologies and contg. security-relevant data such as postal charges already incurred and those remaining available. The reserve store can be operated selectively as static nonvolatile or dynamic volatile memory. Together with the franking machine it is fed with a common supply voltage (UB) which is checked by a voltage monitor (42), sending an emergency signal to the CPU (12) which branches its program to switch off the machine, block the interrupt handling and change the mode of the reserve store.

Description

The invention relates to a franking machine with an electronic control that accesses a first memory in which security-relevant data is stored and from which this data can be called up again, and with at least one non-volatile reserve memory in which the data of the first memory are stored in the event of a power failure and after voltage recovery the data of the reserve memory can be read out again.

From US-A-4,306,299 a franking machine with a voltage monitoring circuit is known which detects the drop and the return of the operating voltage. The franking machine has a non-volatile reserve memory, in which data from the working memory are stored by a copying process when the operating voltage drops. When the operating voltage rises again, the data stored in the non-volatile memory are transferred back into the working memory of the franking machine.

Furthermore, a franking machine with two reserve memories is known from US-A-4,564,922. One of these memories is a non-volatile read-only memory, while the other memory works as a so-called shadow working memory, which has two memory sections. A first memory section serves as volatile working memory, while a second memory section is provided as non-volatile memory. In the event of a voltage drop, data is stored in the shadow RAM transferred from the volatile memory section to the non-volatile memory section by a copying operation. After the voltage has returned, data which were stored in the non-volatile memory section of the shadow RAM are read out to a computer unit and compared with non-volatile data of the read-only memory for correspondence.

A franking machine is known from EP-A-0 572 019 which has at least two non-volatile memories. If the operating voltage drops, safety-relevant data is written into both non-volatile memories. After voltage recovery, the data from the two memories are transferred to the computer of the franking machine by means of a copying process and there checked for identity.

The known devices and methods each copy an entire data set in the event of a voltage drop and on voltage recovery. This means that a large amount of data must be transferred between the memories. During this transmission, read and write errors can occur which impair the reliability of the franking machine. The multiple storage in non-volatile memories and the subsequent comparison of the data sets with one another increases the data security for franking machines, but when interference signals occur, which are caused, for example, by voltage induction or voltage peaks, the data that is transferred from various memories to the computer during data transfer , influenced in the same way so that a systematic data error can occur, in which an identity of the different data sets is simulated.

It is an object of the invention to provide a franking machine which, in the event of a power failure and when the power returns, reliably stores the security-relevant data without additional auxiliary energy.

This object is achieved for a franking machine according to the preamble of claim 1 in that the reserve memory can be operated either as a static non-volatile memory or as a dynamic volatile memory, that the reserve memory and the franking machine are supplied from a common supply voltage, and that the control at If the supply voltage drops to a specified value, the reserve memory sets to static operation and dynamic operation when voltage returns.

The invention is based on the consideration of eliminating the copying process required in the known prior art. The errors that occur during data transmission can then be avoided. Accordingly, two modes of operation are provided for the reserve memory in the invention. On the one hand, the reserve memory can be operated as a static, non-volatile memory; another time as dynamic volatile memory. In static operation, the data stored in the reserve memory are quasi frozen, with the reserve memory no longer requiring any further power supply in this state. When the voltage returns, the cells of the reserve memory are put into the dynamic state, in which renewal cycles are continuously required for the memory content.

In the invention, therefore, no copying process has to be carried out between different memories or between memory sections of a memory, as a result of which the data in the reserve memory are safe even at a high interference signal level. When switching from static to dynamic operation and vice versa, the memory cells are loaded so that their service life is limited. Furthermore, the life of the reserve memory is adversely affected by read operations in which the individual memory cells must be erased and their original values rewritten. However, for applications in a franking machine this type of reserve memory is possible if you limit yourself to a few write and read cycles, for example to the storage of security-relevant data for which the number of read and write cycles is relatively small depending on postage usage.

In a preferred embodiment, a ferroelectric memory is provided as a reserve memory. With this technology, the memory cells contain ferroelectric material as the storage medium. The data are stored as states of storage capacitors. These storage capacitors form the memory cells of the ferroelectric memory. In the static operating mode, the data are defined by the polarization state of the memory cells; in the dynamic operating mode, the data are mapped as charge states of the memory cells. The use of a ferroelectric memory in conjunction with conventional other technologies for working memory and non-volatile memory, for example battery-buffered memory, has the advantage that the simultaneous occurrence of write and read errors in the presence of interference signals due to different memory technologies is avoided.

Another development is characterized in that an area of the reserve memory is provided for storing a control program. In this case, the reserve memory serves as a read-only memory, which at least partially replaces the otherwise conventional ROM module in this application. This further development reduces the hardware expenditure for the franking machine. It is also possible to provide an area of the reserve memory as a working memory for the control.

In order to avoid that when writing to the reserve memory, in which the control program is also stored in addition to the safety-relevant data, data are written in non-permitted areas which destroy the control program certain areas of the reserve memory are write-protected. The control program or other non-changeable data can be stored in this read-only area.

Figur 1

die Steuerung einer Frankiermaschine in einer Blockdarstellung, sowie

Figuren 2 und 3

die Ablaufschritte beim Einschalten des dynamischen Betriebs bzw. des statischen Betriebs des Reservespeichers.

An embodiment of the invention is explained below with reference to the drawing. It shows:

Figure 1

the control of a franking machine in a block representation, and

Figures 2 and 3

the process steps when switching on dynamic operation or static operation of the reserve memory.

In Figure 1, the controller 10 of the franking machine is shown in a block diagram. It contains a microprocessor 12 which, via a data bus 16 and an address bus 14, has a decoding unit 18, a working memory 20, an EPROM program memory 22, an EEPROM memory for fixed data, a clock module 16 with a battery-buffered first non-volatile memory 26 , a battery non-volatile second non-volatile memory 28, a third non-volatile memory designed as a ferroelectric reserve memory 30, a further decoding unit 32, an interface module 34 for external units and an interface module 36 for a display and for input means. The two decoding units 18 and 32 are combined in a customer-specific ASIC module 40. The decoding unit 32 has lines 46, 46a, 46b, which are connected to the chip select inputs CS of the reserve memory 30, the memory 28 and the memory 26. The memories 30, 28, 26 are selected via these lines 46, 46a, 46b in order to read and write data. An output Port1 of the microprocessor 12 is connected to the input via a control line 48 D / NV of the reserve memory 30 connected. Depending on the signal on the control line 48, the reserve memory 30 is switched to the "dynamic memory" or "static memory" mode.

The first, second and third non-volatile memories 26, 28, 30 each store security-relevant data of the franking machine, for example the postage amount still available and the postage amount already issued. The three non-volatile memories 26, 28, 30 operate according to different technologies, so that high memory security is possible even under unfavorable operating conditions. The microprocessor 12 compares the security-relevant data stored in the three memories 26, 28, 30 with one another at certain time intervals. If the data differ from one another, an error signal is generated or an error correction is initiated, as described, for example, in European patent application EP-A-0 572 019.

The microprocessor 12 is connected to a voltage monitoring module 42, which monitors the operating voltage U _B on the line 44. When the franking machine is in operation, the ferroelectric reserve memory 30 is operated with the same operating voltage U _B as the other components of the control system 10. The operation of the franking machine for franking mail using the components shown in FIG. 1 is known per se to the person skilled in the art and must be here not explained in more detail.

FIG. 2 shows in a flowchart the function of the reserve memory 30 when a drop in the supply voltage occurs and when the voltage returns. When the franking machine is switched on or when the supply voltage returns in step 50, the voltage monitoring module 42 reports to the microprocessor 12 that the operating voltage U _{B has been reached} , and initialization takes place in the subsequent step 52 of the microprocessor 12 and the structural units connected to it, the security-relevant data in the memories 26 and 28 also being compared for agreement. If it is determined in step 54 that the security-relevant data do not match, a branch is made to a further program in step 56, in which the error is corrected if necessary. For example, the method described in EP-A-0 572 019 can be used here.

If the security-relevant data is error-free, the processing of interrupts (events to which the microprocessor 12 reacts and triggers control functions) is interrupted in the subsequent step 58 in order to be able to change the operating mode of the reserve memory 30 without interruption.

In the subsequent step 60, the reserve memory 30 is activated via the chip select line 46 by the decoding unit 32, and the microprocessor 12 sends a signal via the control line 48 to the input D / NV of the memory 30 to put it into the dynamic operating state to switch. In this dynamic operating state, the data 30 stored in the memory are continuously renewed. The renewal energy is supplied by the supply voltage U _B.

So-called dummy read cycles are then carried out in the memory 30. These cycles are required to complete data storage, i.e. to change the polarization or charging of the memory cells depending on the control signal 48 present.

In the subsequent step 64, the block for interrupt handling is released. The microprocessor samples the signal of the voltage monitoring module 42. If there is no power failure in step 66, it becomes normal Postage meter operation (step 68) branches and the usual control functions are carried out.

If the voltage monitoring module 42 signals a drop in the supply voltage U _B , step 66 branches to program part A, the sequence of which is shown in FIG. 3. After the machine has been switched off or a supply voltage failure (step 70), the interrupt processing by the microprocessor 12 is blocked in the subsequent step 72. With the remaining electrical energy, for example buffered in a capacitor, the memory 30 is selected via the decoder module 32 and the line 46, and the microprocessor 12 outputs the signal for activating the non-volatile mode of operation of the memory 30 via the control line 48, so that this memory 30 switches to its static mode. In order to determine the memory content of the memory 30, the dummy read cycles already mentioned are carried out in the subsequent step 76. After the final voltage breakdown in step 78, the data in the memory 30 are stored statically. In this state, the memory 30 does not require a voltage supply. It is therefore possible to supply the memory 30 solely from the supply voltage U _B , from which the franking machine, with the exception of the battery-buffered memories 26, 28, also draw its electrical energy.

Claims (10)

Postage meter with an electronic control (10) which accesses a first memory (26, 28) in which security-relevant data is stored and from which this data can be called up again, and with at least one non-volatile reserve memory (30), in the event of a power failure the data of the first memory (26, 28) are stored and after voltage recovery the data of the reserve memory (30) can be read out again, characterized in that the reserve memory (30) can be operated either as a static non-volatile memory or as a dynamic volatile memory that the reserve memory (30) and the franking machine are fed from a common supply voltage (U _B ), and that the control (10) when the supply voltage (U _B ) drops to a predetermined value, the reserve memory (30) on static operation and on voltage recovery stops dynamic operation. Franking machine according to claim 1, characterized in that a ferroelectric memory (30) is provided as a reserve memory. Postage meter according to claim 1 or 2, characterized in that a voltage monitoring module (42) is provided for detecting the drop in the supply voltage (U _B ), which compares the supply voltage (U _B ) with a predetermined comparison value and, when the comparison value is undershot, an interrupt signal for the Control (10) generates, which switches the reserve memory (30) into static operation by emitting a control signal. Franking machine according to claim 3, characterized in that the voltage monitoring module (42) upon voltage recovery generates another interrupt signal for the controller (10), which switches the reserve memory (30) into dynamic operation by means of a control signal. Franking machine according to one of the preceding claims, characterized in that an area of the reserve memory (30) is provided for storing a control program. Franking machine according to one of the preceding claims, characterized in that a further area of the reserve memory (30) is provided as a working memory for the control (10). Franking machine according to one of the preceding claims, characterized in that predetermined areas of the reserve memory (30) are write-protected. Postage meter according to claim 7, characterized in that the memory area assigned to the control program is write-protected. Franking machine according to one of the preceding claims, characterized in that a further reserve memory (26 or 28) is provided which is voltage-buffered by a battery or an accumulator. Postage meter machine according to one of the preceding claims, characterized in that postage data of the postage meter machine, preferably the postage amount still available and the postage amount already issued, are stored in the reserve memory as security-relevant data.

Images