WO1989002140A1

WO1989002140A1 - Data carrying devices

Info

Publication number: WO1989002140A1
Application number: PCT/GB1988/000706
Authority: WO
Inventors: David Eglise; James Joseph Armour
Original assignee: Mars Incorporated
Priority date: 1987-08-28
Filing date: 1988-08-26
Publication date: 1989-03-09
Also published as: JPH03501302A; EP0389484A1; GB8720332D0

Abstract

A machine enables the provision of a product or service, preferably in response to the insertion of coins, but in any event in response to the reading of credit data from a data carrying device which communicates in a contactless manner with a reader of the machine. The reader and data carrying device communicate while the device is located such that it can be removed by a user. The device may be positioned in a coin insertion slot or on a coin dispensing tray. The credit data in the device is not erased. Updating of the credit data is achieved by an instruction issued by the reader to the device, which causes the device to decrement the stored credit data. The provision of a product or service is enabled only in response to receipt of an acknowledgement from the data carrying device that such updating has taken place.

Description

DATA CARRYING DEVICES

This invention relates to data carrying devices, and is particularly concerned with cashless systems in which such devices, in the form of cards or other-shaped tokens, are used in transactions.

There are known cashless systems in which products (which term includes cash) or services can be obtained by inserting a card or token into a reader, the card or token storing a credit value which is caused to be decremented in accordance with the value of the product or^ service obtained. Such systems require a bi¬ directional data flow between the card or token and the reader so that the stored credit value can be -read and updated. One example of such a system is the debit system described - in EP-A-01^7099, which uses an electronic data carrying device which can communicate with a reader in a contactless fashion. Some other systems use magnetically encoded cards.

Conventionally, the data carrying device is held in position throughout the transaction. In many systems, at the beginning of the transaction, the credit data in the device is read out and cleared to zero. At the end of the transaction, a decreased credit value is written into the data carrying device. Often the amount by which the credit value is decreased is variable, e.g. in dependence on the availability of the products requested, the number of products vended, the length of time for which a service is provided, the selection made from products of different values, etc. These factors can be taken into account before determining the updated credit value to be written into the data carrying device. Throughout the transaction,, the data carrying device is retained in position to ensure a reliable data transfer both in reading the credit data and writing an updated value into the device, and to ensure that the device cannot be removed in between these two operations when the device is storing a zero credit value. In a number of vending systems, a switch is provided so that the user can operate this to instruct the machine to write into the device the updated credit value and to release the device for retrieval by the user.

One problem with the arrangements described above is that users tend to be worried about inserting cards or tokens into a machine which then either locks the card or token into position or renders it inaccessible. If the machine develops a fault, it may not be possible for the user to retrieve the card or token. This is of par¬ ticular concern If the user has paid a substantial amount of money to obtain a card or token containing a substan¬ tial credit value.

Another problem with the arrangements described above is that the structure of the card or token reader tends to be bulky and expensive. Although the proposals in EP-A-0147099 mitigate this problem by providing a token which is shaped and sized like a coin and which can be interrogated in a contactless manner by a small reader disposed in a convenient location along a coin path, problems still arise in that it may be difficult to design the token to have a sufficiently small size that it is capable of travelling along paths intended for small coins.

In accordance with an aspect of the present invention, a machine for providing a product or service has a reader for reading a data carrying device, the reader being operable to perform a communication opera¬ tion with the device during the course of which the device can be removed at any time such that further communication is prevented, the arrangement being such that a full communication operation which takes place if the device is left in position involves reading credit data from the device without erasing the credit data and thereafter issuing an instruction to the device to cause the device to reduce its stored credit value, the machine being arranged to generate said signal for enabling pro- vision of a product or service following receipt by the reader of a signal from the data carrying device acknow¬ ledging the instruction to reduce the stored credit value. The invention also extends to a data carrying device for use with such a machine.

By permitting the user to remove the data carrying device at any time, while ensuring that a credit value will still be stored by the device should it be removed, the user's confidence in using the machine is substant¬ ially improved. In addition, because there is no longer any need to retain the device in position during the entire communication operation, the physical structure of the reader can be made simpler and its positioning is subject to fewer restrictions. Similarly, the size and shape of the token is subject to fewer restrictions.

The invention also extends to a method of performing transactions in which a step of communicating with a data carrying device is carried out, a product or service is enabled to be vended if the device has been found during said communication step to contain a sufficient credit value, and the credit value in the token is caused during said communication step to be decreased by an amount corresponding to the value of the vended product or service, wherein the communication step takes place while the data carrying device is positioned such that a user can remove the device at any time, and the credit value contained in the device is caused to be decremented by sending an instruction to the device while the device is currently storing the credit value to cause the device to decrement that value, the method including the step of checking that the instruction has generated a response from the device before enabling a vending step.

Preferably, the user can physically take hold of and remove the data carrying device throughout the communic¬ ation step. It would alternatively be possible to have an arrangement whereby the user had to operate some form of unlocking device such as a door or switch, but prefer¬ ably this would differ from the switch referred to above in that it would merely release the device rather than initiating an updating of the credit value stored by the. device. Thus, there is no requirement for a special structure or circuit to ensure that updating takes place after the user operates a switch and before the device is released.

The invention is particularly applicable to systems in which the amount by which the credit value is de¬ creased may vary. Each instruction may indicate the amount by which the credit value is to be reduced,- or the credit value _^stored in the device may be caused to decrease in successive, preferably equal, steps. In the latter case, removal of the device in the course of the credit value being decremented -would result in the credit value being decreased only in accordance with the number of completed steps. This aspect of the invention is particularly, but not exclusively, useful if the product or service being obtained is vended in successive steps, so that each step or group of steps is associated with a step-wise reduction in the stored credit value. For example, the invention may be applied to electricity meters or telephones, wherein each time a particular amount of electricity has been supplied, or each time a particular interval during a telephone call has elapsed, an instruction may be given to the data carrying device to cause the stored credit value to be decremented by a predetermined (possibly unitary) amount. Alternatively, the invention may be applied to data, video or other information broadcasting systems, such as satellite or cable T.V. systems, where the credit value is reduced in exchange for continued provision of the service. It will, of course, be appreciated that other aspects of the invention not necessarily requiring successive decre¬ menting of credit data in equal steps, are useful for such applications.

Preferably, the machine has a display for displaying the current credit value stored In the carrying device.

The devices used with the machine are preferably arranged in such a manner that removal of the device during a communication operation will neither corrupt the data stored in the device nor cause the stored credit value to be inconsistent with the amount of credit that should be stored having regard to whether or not a trans¬ action has been carried out. Also, the device should preferably be arranged such that if communications are re-established, a transaction initiated during the previous communications operation can b-e successfully completed.

Various preferred ways of achieving this, which are considered independent aspects of the present invention, are- described below.

Preferably, the device sends the acknowledgement to the machine inbetween performing two data^' altering operations, so that if communications are terminated and then re-established, the device can determine from the stored data whether the acknowledgement message should be- re-sent.

Preferably the device stores at least two data values, each of which normally corresponds to the stored credit value, and these are updated in successive opera¬ tions (which could form the two data altering operations mentioned above). As will be explained, this facilitates the recovery of the correct credit data on re- establishment of communication.

A further problem, whereby, data may be corrupted, is particularly likely to arise if the device is of a type which is powered by the machine and which could therefore lose its power on removal from the machine. In order to deal with this problem, it is preferred that the device store, in addition to the two data values mentioned above, at least a third data value which could be (a) a flag whose state is changed inbetween the updating of the first two data values, (b) a third value indicative of the stored credit value, and/or (c) a value indicative of the amount by which the stored credit value is to be reduced. Upon re-establishment of communication it would be possible by taking into account these three values to determine the point at which the communications operation was previously terminated and the way in which the data should be altered in order to restore the appropriate credit value.

An arrangement embodying the invention will now be described by way of example with reference to the accom¬ panying drawings, in which:

Figure 1 is a perspective view of a payphone in accordance with the invention;

Figure 2 is a schematic view illustrating the way in which communications between a reader of the payphone and a data carrying device are carried out; and

Figure 3 is a flow chart illustrating a main part of the operation of the data carrying device. An embodiment of the invention will be described below in the context of a data carrying device in the form of a key-shaped token. However, the invention is equally applicable to other forms of data carrying device, such as coin-shaped or card-shaped tokens. The token is preferably operable to communicate in a contact- less manner, and may employ some of the techniques described in EP-A-0147099, GB-A-2186411 , GB-A-2196450, GB-A-2197107 and U.K. Patent Application No. 8718419-

With reference to Figure 1 , the payphone 2 corres¬ ponds in structure and function to a standard coin- operated telephone, with the exception of the points set out below. Thus, the telephone has a coin entry slot 4, into which a user can insert coins to increase a stored credit value in order to operate the telephone, a key¬ board 6 for push-button dialling of telephone numbers, a display 8 for displaying the amount of remaining credit during the course of a telephone call, a telephone handset 10, and a coin dispensing tray 12 into which the telephone delivers coins corresponding to the value of unused credit at the end of the telephone call.

The telephone 2 can be operated by tokens in addition to coins, and to this end the telephone includes a token interrogator for reading the tokens, and the control circuit is operable to increase the stored credit value in response not only to signals from a coin validator but also to signals from the token interro¬ gator. The telephone may thus correspond in function and circuit to that described in GB-A-2186411 , except that in the preferred embodiment the location of a testing station at which tokens are interrogated, and the technique used for Interrogation and updating of the credit value stored in the token, are different, as will be explained.

The testing station is preferably disposed adjacent the coin entry slot 4. A key-shaped token 14 has a main body portion 16 and a head portion 18. The body portion 16 contains the circuit of the token and a token antenna for communicating with an antenna coil 20 of the telephone interrogator. The token is sized such that the body portion 16 can be inserted into the coin slot 4, but the head portion 18 has a width and/or length such that it cannot pass through the slot. In use, the token is - thus held in position with the body portion 16 adjacent the interrogator coil 20, but with the head 18 of the token remaining physically accessible so that the token can be removed at any time.

Alternatives to this arrangement are possible. For example, the interrogator coil may be positioned as indicated in phantom at 20' in proximity to the base of the coin dispensing tray 12 so that the token can be placed on the tray instead of into the coin slot 4. Alternatively, the interrogator coil could be located under the top surface 22 of the telephone housing so that the token need only be placed on top of the telephone housing in order to operate the telephone. If the invention were embodied in a product vending machine, the coil could be located for interrogating tokens placed in the product dispensing structure.

The communications between the token and interro¬ gator will be described below, with reference to Fig. 2, mainly in the context of the use of the interrogator in the payphone 2. Clearly however, corresponding operations would take place if the interrogator were to be used in a different type of host machine, such as a domestic electricity or gas meter.

The token interrogator is capable of detecting the presence of the token using the interrogator coil 20. Once the presence has been sensed, a communication oper¬ ation is commenced. Initially, security codes are ex¬ changed between the token and the interrogator so that each can check the validity of the other. Then, possibly following a request from the interrogator, the token transmits a number corresponding to its stored credit value to the interrogator, as indicated at 102 in Figure 2. Following receipt of that number, assuming that it represents a credit value which is sufficient to enable operation of the payphone, the interrogator transmits an instruction, indicated at 104 in Figure 2, for the token to decrement its stored value, e.g. by a unitary amount corresponding to 10p in British currency. Prior to receipt of this instruction, the token is still storing its original credit value. Immediately upon receipt of the instruction, this credit value is decremented appro¬ priately, and a confirmation message 106 is sent to the interrogator. This confirmation message may comprise the updated, I.e. reduced, credit value.

At that stage, as indicated at 108, the interrogator issues a signal to instruct the host machine, in this case the telephone, to proceed with a vending operation, i.e. to permit use of the telephone.

At a later stage the host machine delivers to the interrogator a request 112 for further credit. This may occur after a predetermined interval if the host machine is a telephone, or after a predetermined amount of electricity has been consumed, if the host machine is an electricity meter. In response to this request, the interrogator issues an instruction 114 to cause the token to decrement its stored credit value. The token responds by decrementing the value and sending the updated value to the interrogator as indicated at 116.

Steps 108 to 116 are repeated until either the user removes the token, or the call is terminated in some other way e.g. by replacing the telephone handset, or until the stored credit value in the token is reduced to zero. If the token is removed, then the interrogator will receive no response to an instruction 114 to decrement the stored credit value, and this causes a signal to be generated to terminate the call. If the handset is replaced, the call is simply terminated as in conventional equipment. If the stored credit value received from the token at 116 is equal to zero, the control circuit responds to this by terminating the call.

Whenever the updated credit value is transmitted to the interrogator, and then transferred^' to the control circuit, this updated value is displayed on the display 8.

One particular way in which the communications operations can be carried out by the token will be described below, although it will be appreciated that this can be varied in a number of ways. In accordance with this preferred embodiment, upon receipt of the instruction 10.4, the token carries out the following operations in sequence:

(1) The token receives the instruction. The instruction contains both a credit reduction value A which represents the amount by which the credit value stored by- the token is to be reducedj and a transaction number XYZ which identifies the particular transaction taking place and which could be a unique, preferably randomly-generated number produced by the machine. Although in the specific example described above the credit value is decre¬ mented only in fixed amounts, by transmitting the value A the same system can be used in other circumstances in which the credit value is reduced by varying amounts.

(2) The values A and XYZ are written into a non¬ volatile memory of the token.

(3) The values A and XYZ are read out of the non¬ volatile memory and checked against the information derived from the received instruc¬ tion. The purpose of^' this operation and the corresponding reading out operations set out below is to perform a check on the operation of the non-volatile memory.

(4) The token sends a message to the interrogator, the message containing the values A and XYZ, in order to request confirmation of the instruc¬ tion.

(5) The token then receives from the interrogator a confirmation, this confirmation also contain¬ ing the values A and XYZ. This step and the preceding step are optional, and it will be noted that they are not included in the diagram of Figure 2.

(6) A flag F1 is set. The flag is formed by a memory location of the non-volatile memory.

(7) A value V1 corresponding to the credit value and stored in the non-volatile memory is read out, reduced by the value A, and written-back into the memory location.

(8) The value V1 is read out and checked.

(9) A flag F2 is set. Preferably the flag F2 is formed by a memory location having an address separate from that of F1 , but in fact a single memory address could be used for both.

(10) A value V2 representing the credit value is decremented by A, in the same way that V1 was decremented at Stage 1 .

(11) The value V2 is read out and checked. (12) The flag F1 Is cleared.

(13) A value V3 also representing the credit value is decremented by A.

(14) The value V3 is read out and checked.

(15) The token sends an acknowledgement (corres¬ ponding to confirmation message 106) to the interrogator. This acknowledgement includes the transaction number XYZ, and if desired it may also include A, and/or the reduced credit value.

(16) F2 is cleared.

It will be appreciated from the above that the setting and clearing of flags is interleaved with the alteration of three values each of which originally represents the credit value prior to the transaction and finally represents the updated credit value. If this sequence of operations is interrupted at any stage, e.g. by removal of the token from the interrogator, then on re-establishment of communication it is possible for the token to determine the point at which the former communi¬ cation operation was terminated, to recover any data which may have been corrupted, to ensure that the stored credit data is correct, and (if the token is re-inserted into the machine from which it was withdrawn before that machine has carried out any other transactions) to complete the transaction.

In order to achieve this, the token operates in accordance with the flow chart of Figure 3 at the time it establishes communication with the interrogator. After an initialisation procedure, possibly involving a validity checking operation as mentioned above, the token proceeds to step 300, at which it checks flag F1. Assuming that the flag is clear the token then proceeds at step 302 to check flag F2. If this is also clear, then it has been determined that no transaction is pending, and the token can then await a new instruction from the interrogator and respond thereto in the manner described above, as indicated at step 304.

Assuming that, at step 302, it was found that flag F2 is set, the token proceeds to step 306. This should only have been reached if flag F1 is clear and flag F2 is set, which means that the previous communication opera¬ tion was interrupted after stage 12 and before stage 16 in the above sequence of operations. At step 306, the token reads out the values V1 , V2 and V3- V1 and V2 should be found to be equal. V3 is then set equal to V1 , the acknowledgement message is transmitted and flag F2 is cleared. This completes the transaction. It should be understood that the host machine will respond only to the first acknowledgement it receives from the token. Accordingly, even if the first communication operation reached the stage at which the acknowledgement was sent, the repeating of this acknowledgement at step 306 will not cause any problems. Of course, if the token has been re-inserted in a different machine, the acknowledgement will be ineffective because the transaction number will not be recognised by the new machine. Indeed, the new machine will probably not be in the middle of a trans¬ action, and therefore would disregard the acknowledge¬ ment.

Assuming that at step 300 the flag F1 was found to be set, the token would then proceed to step 308 to check flag F2. If this is found to be set, then it is deter¬ mined that the previous communication operation was altered after stage 9 and before stage 12 in the above sequence. Accordingly, the value V1 should be equal to V3 - A. Thus, at step 310, the token proceeds to set V2 = V1 , to clear flag F1, to set V3 = V1 , to transmit the message and then to clear flag F2.

If at step 308 it is found that F2 is clear, this indicates that the previous communication operation was altered after stage 6 and before stage 9. Accordingly, the value V2 should be found to be equal to V3. At step 312, the token proceeds to make V -= V3 - A, to set F2, to make V2 = V3 - A, to clear F1, to make V3 = V3 - A, to send the acknowledgement message and then to clear F2.

It will be appreciated from the above that, after the acknowledgement has been sent, a data altering opera¬ tion is carried out. In this particular embodiment this involves the clearing of F2, although another form of operation could be carried out (such as the updating of a credit value). This ensures that the token- can determine, upon re-establishing communication, whether the previous communication operation included the sending of the acknowledgement.

The particular sequence of steps shown in Figure 3 involves the checking of flags to determine the point at which the previous communication sequence was halted. Although this is not necessary, it is a speedier process than comparing data values. The operations carried out in dependence upon the states in which the flags are found ensure that any data corruption which may have occurred at the end of the preceding communications operation as a result of the token being in the process of writing data when power is lost will not affect the data finally stored at the end of the new communication ^" operation. Furthermore, the use of three data values in addition to the storage of the value A enables a cross¬ checking operation to be carried out so as to avoid problems which might arise due to faulty memory devices. The above description mentions various points in the flow chart of Figure 3 where data values can be found to be equal. If desired, these can be checked by the token to ensure that they are indeed equal, and if not, because of for example faulty memory devices, some form of error procedure can be initiated.

It will be clear that machines in accordance with the invention can be arranged to provide goods or services until the credit data in the data carrying device is reduced to zero. However, the machines could also be arranged so that goods and services are provided after the credit data is reduced to zero. Thus, there may be provision for an "overdraft" facility whereby continued use of the machine is permitted, preferably accompanied by an updating of the information stored by the data carrying device to reflect the value of the goods or services provided. The credit data could continue to be decremented below zero, or a second data value representing the overdraft could be incremented.

It will be further appreciated from the foregoing that, in the normal course of operation of the machine, It is merely necessary for the data carrying device to update the credit value to reflect the amount by which this has changed during the course of a transaction. Although this has been described as being achieved by decreasing a number representing credit value, it could equally well be achieved by increasing a number. Accordingly, references herein to reducing a credit value should be considered to include such alternatives.

Claims

CLAIMS :

1. A machine for generating a signal to enable the provision of a product or service, the machine including a reader for reading a data carrying device, the reader being operable to perform a communication operation with the device during the course of which the device can be removed at any time such that further communication is prevented, the arrangement being such that a full commun¬ ication operation which takes place if the device is left in position involves reading credit data from the device

• without erasing the credit data and thereafter issuing an instruction to the device to cause the device to reduce its stored credit value, the machine being arranged to generate said signal for enabling provision of a product or service following receipt by the reader of a signal from the data carrying device acknowledging the instruc¬ tion to reduce the stored credit value.

2. A machine as claimed in claim 1, wherein the reader is operable to communicate with the data carrying device in a contactless manner.

3- A machine as claimed in claim 1 or claim 2, including means for supporting the device during the communication operation in such a manner that the device can be taken hold of and removed by a user.

4. A machine as claimed in any preceding claim, having means for displaying an amount corresponding to the updated credit value.

5. A machine as claimed in any preceding claim, wherein the instruction includes data indicative of the amount by which the stored credit value should be reduced, thereby to enable credit values to be reduced in different amounts.

6. A machine as claimed in any one of claims 1 to 4, wherein the machine is operable successively to issue instructions to the data carrying device so as to cause the device to reduce its stored credit value in a step- wise manner.

7. A machine as claimed in claim 6, wherein each instruction is arranged to cause the device to reduce the stored credit value by an equal amount.

8. A machine as claimed in claim 6 or claim 7, the machine being arranged to generate signals to cause at least one product or service to be vended in successive steps, each step being associated with an instruction to cause the stored credit value of the device to be reduced.

9- A machine as claimed in any preceding claim, the machine being an electricity meter.

10. A machine as claimed in any one of claims 1 to 8-, the machine being a payphone.

11. A machine as claimed in any one of claims 1 to 8, the machine being a broadcast signal receiving device.

12. A data carrying device for a machine as claimed in any preceding claim.

13- A device as claimed in claim 12, the device being arranged to carry out two data altering operations at successive stages, and being operable to send the acknowledgement αf receipt of the instruction to reduce the stored credit value at a time between the two data altering stages, the device being operable at the beginning of a communications operation with the machine to determine from the stored data whether one or both of the data altering stage's had been reached at the termination of a previous communications operation, ^' and to resend the acknowledgement and perform the second data altering stage if it is determined that the first, but not the second,, data altering stage had been reached during the previous communications operation.

'14. A device .as claimed in claim 13_» wherein the first and second data altering stages each involves the changing of the state of a flag, the device further being operable to store two data values each indicative of the credit value and to alter a first of said data values in accordance with the received instruction before one of the flag state altering operations, and the second of the stored data values after that flag ' state altering operation.

15. A device as claimed in claim 14, wherein the device is arranged to transmit the acknowledgement after the second data value is changed and before the second flag state changing operation.

16. A device as claimed in claim 12, wherein the device is arranged to store first and second data values, each indicative of the credit value, and wherein the device is responsive to a received instruction for updating both data values in succession.

17. A device as claimed in claim 13 , wherein the device is arranged to store two data values each indica¬ tive of the credit value, and wherein the first data altering stage involves updating a first of the data values in accordance with a received instruction, and the second data altering stage involves updating the second data value in accordance with said received instruction.

18. A device as claimed in claim 16 or 17, the device also being arranged to store flag data and to alter the state of the flag data between the alterations of the first and second data values.

19- A device as claimed in any one of claims 14 to 18, the device further storing a third data value which is either indicative of the credit value or indicative of the amount by which the credit value is to be reduced in accordance with a received instruction, the device being operable at the beginning of a communication operation to check for any inconsistencies between the data values, and being further operable thereafter if necessary to rectify any such inconsistencies.

20. A device as claimed in claim 19 when dependent upon claim 14, claim 15 or claim 18, wherein the device is arranged to take into account flag data in determining how to rectify the data values.

21. A combination of a machine as claimed in any one of claims 1 to 11, and a data carrying device as claimed in any one of claims 12 to 20.

22. A method of performing a transaction in which a step of communicating with a data carrying device is carried out, a product or service is enabled to be vended if the device has been found during said communication step to contain a sufficient credit value, and the credit value in the token is caused during said communication step to be decreased by an amount corresponding to the value of the vended product or service, wherein the communication step takes place while the data carrying device is positioned such that a user can remove the device at any time, and the credit value contained in the device is caused to be decremented by sending an instruc¬ tion to the device while the device is currently storing

-^■ the credit value to cause the device to decrement that value, the method including the step of checking that the instruction has generated a response from the device before enabling a vending step.

23- A coin-operated machine, the machine having a coin entry means to permit a user to insert coins, and means responsive to the insertion of such coins to enable the provision of a product or service, wherein the machine further includes a reader for reading a data carrying device removably positioned at said coin entry means and is operable to enable the provision of a product or service in response to reading data from such a device, the reader being arranged to read credit data from the data carrying device without erasing the credit data and thereafter to issue an instruction to the device to cause the device to reduce said stored credit value.

24. A machine for generating signals to enable the provision of products or services, the machine having a dispensing structure from which a user can retrieve items, such as coins or said products, wherein the machine further includes a reader for reading a data carrying device removably positioned at said dispensing structure and is operable to enable the provision of a product or service in response to reading data from such a device, the reader being arranged to read credit data from the data carrying device without erasing the credit data and thereafter to issue an instruction to the device to cause the device to reduce said stored credit value.