EP0560714A2 - Postage meter - Google Patents

Abstract

Franking machine The data memory (RAM) (3) containing the postal data corresponding to value quantities, of an electronically controlled franking machine, together with a computer unit (1) is enclosed on a carrier plate in a sealed housing part. In the case of a defect of an element enclosed in this housing part, the entire assembly unit comprising the carrier plate with the housing part is exchanged. For the subsequent forgery-proof transmission of the data from the data memory (3) to that of the new assembly unit, two connector units (11, 12) are provided in the data transmission line between the data memory (3) and the computer unit (1). One of these is closed by a connecting connector unit (8) so that, when the franking machine is operated, the data flow is looped through the connecting connector unit (8). A write line (9) provided in addition to the data transmission line (2 bus transceiver) is used for reading in the operating data during the franking so that it is not accessible via any connector unit. For the data transmission, the connector unit (11) of the defective assembly unit is connected to the connector unit (12) of the exchanged new assembly unit after removal of the connecting connector unit (8). <IMAGE>

Description

The invention relates to a franking machine with at least one electronic computer (CPU) which is connected to at least one data memory (RAM) for postal data containing amounts of value.

With franking machines of this type, it is customary to seal the outer machine housing in order to ensure that interventions in the machine are only carried out by an authorized person. However, it has been shown that abuses cannot be ruled out as a result and considerable losses in value are possible due to incorrect access to the data storage device.

The invention is based on the object of avoiding the disadvantage mentioned and consequently of finding a franking machine in which access to the data storage containing its quantities is prevented on the occasion of repair work. According to the invention, this task is solved in that the computer and the data memory are enclosed on a common assembly unit in a sealed housing part.

The invention shows that in the event of an error in the computer unit or in the data memory, these must be replaced. This is easily possible because they are located on a common mounting element so that they can be replaced together with this and the sealed housing. The machine housing can therefore be opened for repair work which does not concern the electronics without being able to access the electronic components.

Known franking machines of the type mentioned at the outset have the further disadvantage that, in the event of a defect in the electronic computer system of the franking machine, the data corresponding to the amounts of value can no longer be read out. This disadvantage is avoided by a preferred embodiment of the invention, so that in the event of a defect in the computer system of the franking machine, the unadulterated receipt of data is guaranteed and can be reliably carried out after repair. For this purpose, the computer unit (CPU) is connected to the data memory via a write line for reading in the working data and a data transmission line (BUS transceiver), and the data transmission line has a first and a second plug unit, which are arranged outside the sealed, sealed housing part on the mounting part and of which the first is open, while the second is in plug connection with a connector unit, so that the data transmission via the connector unit is looped.

A further embodiment of the invention ensures that the data transfer from the memory of the defective assembly unit can only be carried out once. For this purpose, mechanical locking means are provided which are operatively connected to a switch which sets an electronic identification mark (flag). This identifier is set when the defective assembly unit is removed. A second, indelible identifier is placed on the new assembly unit when the data is transferred, so that the defective assembly unit is no longer suitable for a second data transfer.

Furthermore, a method for data backup is proposed, which is characterized by replacing the old mounting part carrying the defective computer system with a similar new mounting part, with the corresponding electronic elements enclosed in a sealed housing unit, removing the looping connector unit of the old mounting part, producing one Plug connection between the second plug unit of the old assembly part and the first plug unit of the new assembly unit, transfer of the data content of the old data memory to the new data memory via the plug connection produced and removal of the old assembly part with the old data memory.

• Fig.1 ein Blockschema mit erfindungswesentlichen Teilen der Frankiermaschine,
• Fig.2 eine unvollständige Aufsicht auf eine elektronische Bauteile einschliessendes Montageeinheit,
• Fig.3 einen Querschnitt durch die Montageeinheit nach Fig.2 entlang einer Verbindungslinie zwischen den plombierten Verschlussschrauben, ohne elektronische Bauteile,
• Fig.4 einen Teil der Montageeinheit nach Fig.2 im Bereich des schlaufenden Steckers, in teilweise geschnittener Seitenansicht,
• Fig.5 eine verkürzte Darstellung des Verriegelungsbolzens,
• Fig.6 eine vergrösserte Darstellung eines Teils eines Verriegelungsbolzen, mit anliegendem Signalschalter,
• Fig.7 eine Darstellung einer neuen Montageeinheit entsprechend Fig.2 mit gekoppelter alter Montageeinheit,
• Fig.8 eine Seitenansicht beider, miteinander gekoppelter Montageeinheiten nach Fig.7,
• Fig.9 eine schematische perspektivische Ansicht einer Montageeinheit mit elektronischen Bauteilen und ihrem Datenfluss,
• Fig.10 eine Darstellung entsprechend Fig.9 einer neuen Montageeinheit mit angekoppelter alter Montageeinheit, mit Andeutung des Datenflusses bei der Datenübergabe und
• Fig.11 A-F Programmablaufpläne für die Datenübertragung von der alten zur neuen Montageeinheit.

Further embodiments of the invention can be found in the following description with reference to the drawings. It shows:

• 1 shows a block diagram with parts of the franking machine that are essential to the invention,
• 2 shows an incomplete supervision of an assembly unit including electronic components,
• 3 shows a cross section through the assembly unit according to FIG. 2 along a connecting line between the sealed screw plugs, without electronic components,
• 4 shows a part of the assembly unit according to FIG. 2 in the area of the looping plug, in a partially sectioned side view,
• 5 is a shortened representation of the locking bolt,
• 6 shows an enlarged view of part of a locking bolt, with a signal switch attached,
• 7 shows a representation of a new assembly unit corresponding to FIG. 2 with a coupled old assembly unit,
• 8 shows a side view of both, coupled assembly units according to FIG. 7,
• 9 shows a schematic perspective view of an assembly unit with electronic components and their data flow,
• 10 shows a representation corresponding to FIG. 9 of a new assembly unit with an attached old mon day unit, with indication of the data flow during data transfer and
• Fig. 11 AF program flowcharts for data transfer from the old to the new assembly unit.

The structure and mode of operation of the electronic postage meter machine can be described, for example, in accordance with US Pat. Nos. 4,520,725 (EP-A-0,105,424), US-A-4,898,093 (EP-A-0 222 275), US-A- 4,788,623 (EP-A-0214410), US-A-07 / 490,037 (EP-A-0 386 390), US-A 07 / 490,040 (EP-A-0 387 202), US-A-07 / 499,604 (EP-A-0 390 731), and it is therefore not necessary to describe these details, which are not immediately essential for the invention, in more detail. Correspondingly, the postage meter machine has at least one computer unit (CPU) 1 and a plurality of data memories (RAM, PROM) which are connected to one another via a data transmission line (bus transceiver) 2. The present invention is concerned with measures which are intended to ensure that the changeable data memories are not accessed by external means, e.g. B. during repair work, can be changed and that they are not lost in the event of damage to electronic components.

In this respect, the non-volatile, changeable data memory 3 is of particular importance for the stored amount of value required for franking and accordingly also for the used amount of value. A replenishment of this amount of value is via a coded, e.g. Data exchange by telephone or in writing with the post office is possible (EP-A-0 390 731 or US-A-07 / 499,604).

The non-volatile, battery-supported data memory 3 (NOVRAM) can be based on different contents, i.e. be divided between the total amount of all frankings that have been made and various user accounts, which are also divided into different sub-accounts that can be debited by the respective user of the franking machine when franking. The allocation to one of the different user accounts takes place using an identification key, e.g. corresponding to the above-mentioned US-A-4 788 623 (EP-A-0 214 410).

So that the data storage device 3 cannot be replaced without authorization, it is enclosed in a housing part 4, the flat hood 5 of which is fastened to the carrier plate 7 by four sealing screws 6. In addition, the at least one data memory 3 is not pluggably connected to the electronic carrier plate 7 (circuit board). Plugging is thus avoided, since the data contained therein could be changed by accident or falsification if the plug was changed. In addition, the data traffic, e.g. the interrogation of the remaining amount of value, etc., enables connection of the data memory 3 to the computer unit (CPU) via a connector unit 8 provided in the data transmission line 2 (bus transceiver), in which the data transmission is looped. The data transmission line 2 (bus transceiver) forms an amplifier which can be switched on and off and which can reverse the direction. It also takes over buffer functions to block out disturbances and acts as a data filter by only allowing data in a certain direction to pass through, e.g. after the assembly unit 10 has been replaced, the old assembly unit 10 or its data memory 3 are to be transferred.

In addition to the data transmission line 2, there is an independent write line 9, via which data are read into the data memory 3, so that the data content changes. Since this write line is not looped over the connection starter unit, the data memory 3 cannot be changed from outside the sealed housing part 4. In the de-energized state or in the idle state of the computer unit 1, the write line 9 is switched such that data can only be read from the data memory 3.

If an error occurs on an electronic element connected to the carrier plate 7 in the sealed housing part 4, e.g. by failure of a microprocessor or by a short circuit in the supply, so instead of opening the sealed housing part 4 and replacing or repairing the part in question, the assembly unit 10 composed of the carrier plate 7 and the housing part 4 is replaced by a new one. Thereafter, the connector unit 8 is removed from the old carrier plate 7 and the mating connector 11 thus released is inserted into a free connector unit 12 (FIGS. 1 and 2) of the new assembly unit 10 'additionally provided on the data transmission line 2. As a result, the computer unit (CPU) of the new assembly unit 10 'can read in the data from the data memory 3 of the old assembly unit 10. This data flow is indicated in FIG. 10 by the arrows 14 to 16. The data flow during normal operation is indicated in FIG. 9, in which the loop is symbolized by the arrows 17, 18 via the connector unit 8.

In order to be able to remove the assembly unit 10 with a defective assembly unit 10 or with a defective electronic component from the franking machine, a locking bolt 20 must first be removed when the franking machine is switched off. This extends transversely through the housing part 4 and through two wall parts 21, 22 of the inner housing frame of the franking machine which laterally surround the housing part 4. Corresponding through openings are provided in these parts.

In order to enable a shift in their level despite this locking of the assembly unit 10, so that the plug units 24, 25, 26 for the keyboard print, the power print and the Interfaceprint of the franking machine is possible without having to disassemble and consequently replace the assembly unit 10, the push-through openings for the locking bolt 20 and for two additional guide pins 27 are shaped as a slot 28.

The pulling out of the locking bolt 20 secured by a split pin 30 or a snap ring not only causes the assembly unit 10 to be released for its removal, but also causes an electronic marking (flag) to be set in one of two via a signal switch 31 enclosed in the housing part 4 battery-supported 1-bit memories provided in the assembly unit 10. This marking thus indicates that the assembly unit 10 has been removed. For this switch actuation, the locking bolt 20 has a constriction 34 formed by two conical regions 32, 33, into which the switch knob 35 moves when the locking bolt 20 is pulled out. Both 1-bit memories can be read and reset by the computer. The second memory can also be set by the computer.

The new assembly unit 10 'is installed in the machine in reverse order. It also has an identification tag (flag). After the connection plug unit 8 has been removed, the old, defective mounting unit 10 with its vacant lower plug unit 11 is inserted into the plug unit 12 of the new mounting unit 10 ', so that it assumes the vertical position shown in FIG. The franking machine is then connected to power, a special key is inserted into its key holder ((US-A-4 788 623 (EP-A-0 214 410) and a key (DEST ") on the input keyboard of the franking machine is pressed. These commands start the transfer program for the data transfer from the old, disassembled, to the new, assembled assembly unit 10 ', which is preceded by a plausibility program described in more detail below. Finally, the identifier (flag) of the new assembly unit 10' is deleted by your computer and in the old defective assembly unit 10, a second, indelible identifier (flag) is set so that the old assembly unit 10 is not improperly suitable for a second data transfer. The sequence of the transfer program is indicated on the display panel by the indication "transfer" and at the end of the transfer program "End" appears there, then the franking machine is switched off and de r Postal tariff memory 36 (model prom) and a code memory 37 (US-A-07 / 499.64 (EP-A-0 390731) removed from the old assembly unit 10 and connected to the new assembly unit 10 '. This is possible because they are arranged outside the sealed housing part 4. Finally, the old assembly unit 10 is detached from the new assembly unit 10 'and again provided with its connector 8. The power is then switched on again and the franking machine is tested with the machine housing open.

Before the data from the old data memory 3 are read into the new one, various control programs or plausibility programs are to be carried out, which are intended to ensure that non-faulty data can be read again.

According to a first control program, it is determined which of several data blocks of the data store 3 is faulty, because for security reasons the postal data are stored several times at different locations in the data store 3. In the error-free state, the content of all data blocks is identical. The faulty block can be determined according to the control program by summing the contents of different blocks. In the case of a majority of data blocks with the same data content, it is assumed that this content is correct and can be transferred to the new data memory 3.

If the data memory 3 of a computer system has failed completely, then no more data can be transmitted and a zero data note is sent accordingly. For this reason, there are at least two mutually independent microprocessor systems with all the necessary peripheral elements on the carrier plate 7. These computer systems are connected to each other in series, and they manage the postal data independently of one another. The control program described above is carried out for all of these computer systems.

According to a further control program, it is checked whether the data content of the respective data memory of the removed carrier plate 7 is larger than that of the installed new carrier plate 7. In this way it is ensured that the data content can be entered to a value set equal to zero.

• Error 80: Das Zählwerk (Register) der neuen Montageeinheit 10 hat nicht den Wert Null.
• Error 81: In der neuen, zur Datenübergabe (Transfer) angeschlossenen Montageeinheit ist die Markierung (Flag) nicht gesetzt.
• Error 82: Die neue, zur Datenübergabe angeschlossene Montageeinheit ist für die Datenübergabe gesperrt oder sie spricht nicht an.
• Error 2D: Netzunterbruch: der Motor, das Codeprogramm oder die Datenübertragung (Transfer) sind zu starten
• Error 86: Fehlerfeststellung bei der Ueberprüfung, die Datenübergabe ist zu wiederholen,
• Error 538: Blockfehler
• Error 87: Uebertragungsfehler in den Postdaten von Z80 zu Z8,
• Error 88: Beide Speichersysteme ungültig. Die Daten sind nicht rekuperierbar.
• Error 544: Uebertragungsfehler Z8 zu Z80,
• Error 83: Die zweite Sperrmarkierung kann an der alten Montageeinheit 10 nicht gesetzt werden.
• Error 84: Die erste Markierung (Flag) der ausgebauten Montageeinheit 10 ist nicht rücksetzbar.
• Error 582..597: Unterschied Z80 - Z8, z.B. im Total, in einem der Benutzerkonten etc.

The AF also represent the program sequences in the program representation. The different function fields mean, for example: start, end, decision, function, complex function, output. The specification Z8 relates to a control computer, while the specification Z80 relates to the computer assigned to the operating and display field (keyboard). The errors that may occur are numbered and appear in the display with this number and the name "error". The error numbers have the following meaning:

• Error 80: The counter (register) of the new assembly unit 10 does not have the value zero.
• Error 81: In the new assembly unit connected for data transfer (transfer), the Mar The flag is not set.
• Error 82: The new assembly unit connected for data transfer is blocked for data transfer or it does not respond.
• Error 2D: mains interruption: the motor, the code program or the data transfer (transfer) must be started
• Error 86: Error determination during the check, the data transfer must be repeated,
• Error 538: Block error
• Error 87: Transmission error in the postal data from Z80 to Z8,
• Error 88: Both storage systems invalid. The data cannot be recovered.
• Error 544: transmission error Z8 to Z80,
• Error 83: The second lock mark cannot be set on the old assembly unit 10.
• Error 84: The first marking (flag) of the removed assembly unit 10 cannot be reset.
• Error 582..597: difference Z80 - Z8, e.g. in total, in one of the user accounts etc.

Claims (13)

1. Postage meter machine with at least one electronic computer (CPU), which is connected to at least one data store (3, RAM) for postal data containing value quantities, characterized in that the computer (1) and the data store (3) are on a common assembly unit (10, 10 ') are enclosed in a sealed housing part (4). 2. Postage meter according to claim 1, characterized in that the computer (1) is connected to the data memory (3) via a write line (9) for reading in the working data and a data transmission line (2) (BUS transceiver), the data transmission line ( 2) has a first and a second plug unit (12, 11) which are arranged outside the sealed sealed housing part (4) on the mounting part (7) and of which the first (12) is open while the second (11) is in Plug connection is with a connector unit (8), so that the data transmission via the connector unit (8) is looped. 3. Franking machine according to claim 1 or 2, characterized in that the data memory (3) spatially distributed has several identically designed data blocks in which the same postal data is stored. 4. Franking machine according to claim 2 or 3, characterized in that at least two mutually independent computer systems are present on the mounting unit (10, 10 '). 5. Franking machine according to one of claims 1 to 4, characterized in that for the data transmission the computer system in question is programmed to check the condition that the content of the old data memory is larger than that of the corresponding, replaced new data memory (3). 6. Franking machine according to one of claims 1 to 5, characterized in that the mounting unit (10) with the sealed housing part (4) on an inner frame (21, 22) of the franking machine is mechanically secured by a releasable locking element (20) is in operative connection with a signal transmitter (31) enclosed in the sealed housing part (4), for emitting a signal which sets a first marker (flag) when unlocking to a battery-supported memory enclosed in the sealed housing part (4). 7. Franking machine according to claim 6, characterized in that the releasable locking element is a bolt (20) extending through the housing part (4) and permanently connected to the franking machine frame parts (21, 22) and the signal transmitter from a with the bolt in contact standing switch (31). 8. Postage meter machine according to claim 6 or 7, characterized in that the computer (1) enclosed in the housing part (4) is programmed, after completion of the data transfer from the memory of the old to that of the new mounting unit (10, 10 ') in the battery-supported To set the memory of the old assembly unit (10) a second, non-resettable marker (flag), by which a second data transfer from this old assembly unit (10) is impossible. 9. A method for securing postal data in the event of a defect in a computer system of a franking machine according to claim 1, characterized by replacing the old mounting unit (10) carrying the defective computer system with a similar new mounting unit (10 '), with the corresponding electronic one, in a sealed one Housing part (4) enclosed electronic elements (1,3), removing a looping connector unit (8) of the old assembly unit (10), establishing a plug connection between a second connector unit (11) of the old assembly unit (10) and a first connector unit (12) the new assembly unit (10 '), transfer of the data content of the old data store (3) to the new data store (3) via the plug connection produced and removal of the old assembly unit (10) with the old data store (3). 10. The method according to claim 9, characterized in that at least two mutually independent computer systems are programmed for the execution of verification runs, the data being determined by comparison before transferring the data from an old data memory (3) to a new data memory (3 '), which of several data blocks intended for storing the same postal data is faulty. 11. The method according to claim 9 or 10, characterized in that the transfer of the postal data from the old data store (3) to the new one is carried out only after the execution of a test program which checks whether the content of an old data store (3) in question is larger is the content of the corresponding new data store (3). 12. The method according to any one of claims 9 to 11, characterized in that when a new assembly unit (10) is replaced by an old one, at least one programmable data memory (24, 25) (PROM) before the data content is transferred from the old to the new data memory ( 3 ') from the old assembly unit (10) and connected to the new assembly part (10') after the transmission of the said data content has ended. 13. The method according to any one of claims 9 to 12, characterized in that when dismantling the old assembly unit (10) by a mechanical signal transmitter (31) in a battery-backed memory of this assembly unit (10) a first mark (flag) is set and after completion the data transfer by the computer in a battery-backed memory, a second marker is set, which blocks the old assembly unit (10) for further data transfer.

Images