EP0694886A1 - Electronic franking system with a rechargeable operating programm in situ - Google Patents

Abstract

The franking machine has a microprocessor (1) connected by an address bus (11) and a data bus (10) to a non-volatile memory (2) that holds the operating program for the franking machine. The non-volatile memory is flash memory with its address space divided into multiple sectors (S1-S8) selectively addressable from the address bus. An address decoder circuit (3) is connected between the address bus and a terminal (WE) of the memory circuit authorising or inhibiting writing to the memory. The address decoder is configured so the microprocessor is blocked from writing when the decoding circuit detects a control signal a first level and is allowed to write when the control signal is at the second level. The control signal level is set by an externally accessible removable link (4). <IMAGE>

Description

The invention relates generally to the field of franking machines which are now widely used in corporate mail forwarding offices.

It relates more particularly to an electronic postage system comprising a microprocessor connected by an address bus and a data bus to a non-volatile memory circuit in which an operating program is recorded.

By operating program is meant a program for controlling the microprocessor in order to obtain a desired operation of the latter. It can be used in particular to manage postage amount accounting information. This information generally includes the amount of funds available in the system (this amount being decremented at each postage transaction) as well as the cumulative amount of postage (this amount being incremented at each postage transaction). This information is kept in the so-called descending and ascending registers in non-volatile memory backed up by battery. Most franking systems have two non-volatile battery backed memories in which the descending and ascending registers are duplicated.

Such a franking system is generally mounted inside a sealed enclosure. In known franking systems, the operating program is saved in a memory of the EPROM type. Such a memory requires exposure to ultra violet rays to be erased and then reprogrammed in order to change the operating program. To perform this function, the EPROM memory circuit or box must be mounted in the franking system on a support of so as to be removable. The presence of such a support increases the cost of the franking system. It would be possible to record the operating program in a read / write memory of the RAM type backed up by battery. But such a solution increases the cost of the franking system even more. Furthermore, this arrangement would cause complications to ensure the level of security of the program data required by the Postal Administrations. In other words, it is not planned today to change, in situ in an electronic franking system, the operating program recorded in a non-volatile memory circuit, that is to say without leaving the circuit memory of the sealed enclosure containing the franking system.

The object of the invention is to propose an electronic postage system having a memory circuit arranged in such a way as to allow an in situ change of the operating program recorded in the memory circuit without penalizing the cost price of the system. and without affecting its security level.

To this end, the subject of the invention is an electronic postage system characterized in that the memory circuit is of the flash memory type having a memory space divided into a plurality of sectors selectively addressable from the address bus, in that an address decoding circuit is provided between the address bus and a terminal of the memory circuit authorizing or prohibiting writing to the memory, this decoding circuit being arranged so that the microprocessor is prevented from '' write in a first sector of the memory in which the operating program is recorded when the decoding circuit detects the presence of a control signal set to a first logic level and the microprocessor is authorized to write in said first sector of the memory when the decoding circuit detects the presence of the control signal set to a second level logic, and in that there is provided a loading program recorded in a second sector of the memory protected before mounting the memory circuit in the system against any write access, this loading program being intended to control the microprocessor of such so that it establishes a dialogue with another processor in order to load a new operating program, supplied by this other processor, in place of the operating program already recorded in said first sector of the memory when the control signal is put on a second logical level.

The technology of non-volatile flash memory circuits is starting to appear on the market and is of interest for an electronic postage system. Such a memory circuit has a memory space organized into sectors of fixed size selectively erasable by a microprocessor control. The sectors of such a memory are moreover capable of being selectively protected against any write or erase access. This protection is carried out by configuring the flash memory on a programming bench. This protection can therefore be carried out before mounting the flash memory circuit directly on a printed circuit board. Such a non-volatile memory circuit may be suitable for recording the operating program of a franking machine because it has a sufficiently large memory space.

The decoding circuit prevents untimely modifications of the operating program in the flash memory, for example in the event of a microprocessor malfunction and contributes to system security.

It is even possible to download a new operating program to the flash memory if a telecommunications system is provided between the microprocessor of the franking system and this other processor.

According to an embodiment which is particularly simple to implement, this control signal comes from a conductive line connected to a current source by a removable pin. In this way, when the pin is interposed between the decoding circuit and the current source, the control signal is set to its first logic state. When this pin is removed, the control signal changes logic state which makes the first sector of the memory containing the operating program accessible for erasure and writing by the microprocessor which can then reload a new operating program .

To prevent unauthorized loading of a new operating program in the first sector of the memory, it is provided that the microprocessor, the memory circuit, the address decoding circuit and the removable pin are placed at the inside a sealed enclosure. In this way, only the manufacturer can load a new operating program into the first memory sector.

Other characteristics and advantages will emerge from the following description of exemplary embodiments of the invention made with reference to the drawings.

Figure 1 shows in schematic form a first embodiment of the franking system.

Figure 2 illustrates the organization into sectors of flash memory.

In FIG. 1, the franking system comprises a microprocessor 1 having seventeen address bits A0-A16 and eight data bits D0-D7, for example the integrated circuit known under the reference "80C166" or the integrated circuit known under the reference "ST10". It also includes a non-volatile flash memory circuit 2, for example the integrated circuit known under the reference "29F10PL". This memory has a capacity of 128 Kilo bytes divided into eight memory sectors of 16 Kilo bytes each. These eight sectors are designated by S1 to S8 in FIG. 2.

The data inputs / outputs D0 to D7 of the memory circuit 2 are connected to the respective data inputs / outputs of the microprocessor 1 through a data bus 10 comprising eight data lines. The address inputs A0 to A16 of the memory circuit 2 are connected to the corresponding address outputs of the microprocessor 1 through an address bus 11 comprising seventeen address lines.

The memory circuit 2 also includes a read control input OE, a write control input WR and a box selection input CE. The box selection input CE permanently receives an electrical signal of 0 volts so that the memory circuit 2 receives all the read and write commands from the microprocessor 1.

The microprocessor 1 also has a read control output RD, a write control output WR, a reserved input of a control signal CHPRG, and a serial input port RXD1 and output TXD1.

The read control output RD of the microprocessor is connected to the read control input RD of the memory circuit. The serial RXD1 input and TXD1 output of the microprocessor are connected to a connector 5 through a control bus 12 comprising several control lines.

Furthermore, the input of the microprocessor for receiving the CHPRG control signal is connected through the control bus 12 and a removable pin 4 (in the form of a jumper) to a current source delivering an electrical signal from 5 volts corresponding to a logic level equal to 1.

An address decoder 3 is also provided, having an output connected to the write command input WE of the memory circuit 2.

The address decoder 3 comprises a reversing AND gate 31 with three inputs for receiving respectively the control signal CHPRG and signals coming from the outputs of most significant addresses A15 and A16 of the microprocessor. These last two signals are taken directly from the address bus 11. It also includes a single inverting gate 32 which receives a write command signal coming from the write command output WR of the microprocessor 1. It also includes a another AND reversing gate 33 having a first input connected to the output of gate 31 and two other inputs connected to the output of gate 32. The output of gate 33 is connected to the write command input WR of the circuit memory 2.

The microprocessor 1, the memory circuit 2, the address decoder 3 and the pin 4 are enclosed in an enclosure 20 comprising a hatch 21 giving access from outside the enclosure to the pin 4. The hatch normally closes l enclosure and is sealed to prevent unauthorized access to the interior of the enclosure by a user. As shown in FIG. 1, the connector 5 is freely accessible from the outside of the enclosure 20. However, it could also be enclosed inside the enclosure so as to be accessible only when the hatch 21 is open.

The set of circuits 1,2,3,4,5 is mounted on one or more printed circuit boards (not shown), the terminals of the memory circuit 2 being able to be directly soldered on a printed circuit board.

The memory space of memory 2 is divided into a plurality of memory sectors of identical capacity, in this case eight sectors S1 to S8 of 16 kilobytes each.

A loading program is recorded in sector S1. Furthermore, the sector S1 is protected against erasure or writing, after the loading program is recorded there and before the mounting of the memory circuit 2 directly on the printed circuit board. Such protection is achieved using a specific memory programming device known per se.

An operating program for a franking machine is saved in the S7 and S8 sectors of the memory. Sectors S2 to S6 are left free for recording other data.

These two sectors are accessible by the microprocessor through address bits A15 and A16.

During normal operation of the franking system, the address decoder 3 prevents write access of the microprocessor in sectors S7 and S8 of the memory since the combination of the signals at the input of gate 31 forces the output of the address decoder at a logic level equal to 1 and that this logic level is that which is necessary to inhibit the write command input WR of the memory circuit 2.

Consequently, the address decoder 3 ensures that the operating program recorded in the sectors S7 and S8 of the memory is not altered by a malfunction of the microprocessor for example.

Furthermore, when the franking system is switched on, the microprocessor accesses the first bytes recorded in the sector S1 of the memory which constitute the start of the loading program.

This loading program is first arranged to test during the start of its execution the logic level of the signal CHPRG received by the microprocessor. If this signal at a logic level equal to 1, the loading program starts the execution of the operating program at the same time as it stops. It is therefore the normal operating framework for the franking system.

Now if pin 4 is removed from the electrical circuit between the +5 volt source and the address decoder 3, the CHPRG signal will have a logic level equal to 0. When the CHPRG signal has a logic level equal to 0, the decoder of addresses 3 allows the write command signal WR coming from the microprocessor to pass authorize the microprocessor to write in the sectors S7 and S8 of the memory.

The loading program, upon detection of the CHPRG signal at a logic level equal to 0, controls the microprocessor in such a way that it first erases the content of the sectors S7 and S8 and then establishes communication with another processor connected to the serial input / output ports RXD1 and TXD1 via connector 5 in order to load in situ a new operating program in the sectors S7 and S8, this new operating program coming from the other processor . After loading the new operating program, the loading program may stop and block the operation of the franking system. Mailing system power must be turned off. At this time, pin 4 must again be replaced so that the level of the CHPRG signal is equal to 1. Then the franking machine is switched on again and the loading program as indicated above will start the execution of the new operating program.

As a variant, the signal CHPRG can come directly from the microprocessor which is controlled so as to change the logic level of the signal CHPRG in response to a coded message obtained from the serial input port RXD1. In this variant, the microprocessor of the franking system is connected, for example by a telephone line, to a management center of a fleet of franking systems.

Claims (3)

1.) An electronic postage system comprising a microprocessor (1) connected by an address bus (11) and a data bus (10) to a non-volatile memory circuit (2) in which a program is recorded operating, characterized in that the memory circuit is of the flash memory type having a memory space divided into a plurality of sectors (S1-S8) selectively addressable from the address bus, in that there is provided a address decoding circuit (3) between the address bus and a terminal (WE) of the memory circuit authorizing or prohibiting writing to the memory, this decoding circuit being arranged so that the microprocessor is prevented from writing in a first sector (S7, S8) of the memory in which the operating program is recorded when the decoding circuit detects the presence of a control signal (CHPRG) brought to a first logic level and the microprocessor is authorized to write e in said second sector of the memory when the decoding circuit detects the presence of the control signal set to a second logic level, and in that there is provided a loading program recorded in a second sector (S1) of the memory protected before mounting the memory circuit in the system against any write access, this loading program being provided for controlling the microprocessor in such a way that it establishes a dialogue with another processor in order to load a new operating program, supplied by this other processor, in place of the operating program already recorded in said first sector of the memory when the control signal is set to a second logic level. 2.) The system according to claim 1, in which the control signal (CHPRG) comes from a line conductive connected to a current source by a removable pin (4). 3.) The system according to claim 2, in which the microprocessor (1), the memory circuit (2), the address decoding circuit (3) and the removable pin (4) are placed inside. a sealed enclosure (20).

Images