EP0718800B1 - Franking machine with a spare memory - Google Patents

Description

The invention relates to a franking machine with an electronic Controller accessing a first memory in which security-relevant data is stored and from which these data are available again, and with at least one non-volatile reserve memory, in the event of a power failure the data of the first memory are stored and after Power recovery returns the data of the reserve memory are readable.

From US-A-4,306,299 is a franking machine with a Voltage monitoring circuit known that the sinking and the return of the operating voltage is detected. The franking machine has a non-volatile reserve memory, in the data from the working memory when the operating voltage drops can be saved by copying. If the operating voltage rises again, the im will not volatile memory stored data back into memory transferred to the franking machine.

Furthermore, a franking machine is from US-A-4,564,922 known with two reserve memories. One of these stores is one non-volatile read-only memory while the other Memory works as a so-called shadow work memory, that has two memory sections. A first storage section serves as a volatile memory, while a second Memory section provided as a non-volatile memory is. In the event of a voltage drop, data is stored in the shadow RAM from the volatile memory section to the non volatile memory section transferred by a copy operation. After the voltage returns, data stored in the non-volatile memory section of the shadow memory were saved to a computer unit and with non-volatile data from the read-only memory Matched.

A franking machine is known from EP-A-0 572 019 has at least two non-volatile memories. When the Operating voltage will be safety relevant data in both non-volatile memory inscribed. After voltage recovery the data from the two memories is replaced by a Transfer the copying process to the computer of the franking machine and checked for identity there.

The known devices and methods copy each an entire data set on voltage drop and on voltage recovery. This means that a large number of data must be transferred between the memories. At this Transmission read and write errors can occur which affect the reliability of the franking machine. Multiple storage in non-volatile memories and the subsequent comparison of the data records with each other increases the data security for franking machines, however when interference signals occur, for example caused by voltage induction or by voltage peaks be the data from different stores get to the computer when transferring data, in the same way affected, causing a systematic data error can come up with an identity of different records is faked.

A franking machine is known from EP-A-0 550 994, which has two memories contains which by a controller as static non-volatile memory or can be operated as dynamic volatile memories. The two stores serve both for storing security-relevant data and as working memory. Depending on the level of the supply voltage, the two memories are in switched to static or dynamic operation.

It is an object of the invention to provide a franking machine which is used in the event of a power failure and storage of safety-relevant data when voltage returns Executes data reliably without additional auxiliary energy.

This object is solved by the features of claim 1.

The invention is based on the consideration in the known The copying process required in the prior art is eliminated to let. The errors that occur during a data transfer can then be avoided. Accordingly, in the invention two operating modes are provided for the reserve memory. First, the reserve memory is not as static volatile memory operable; another time than dynamic volatile memory. In static operation, they are stored in the reserve memory stored data quasi frozen, whereby in this state of the reserve memory no further power supply needed more. When the voltage returns, the Reserve memory cells set to dynamic state, in the continuous refresh cycles for the memory content required are.

So there must be no copying between the invention different memories or between sections of memory Memory are performed, which saves the data in the reserve memory are safe even at high interference signal levels. When switching from static operation to dynamic operation and vice versa the memory cells are loaded, so that their lifespan is limited. Furthermore, the lifespan of the reserve memory is impaired by read operations, where the individual memory cells each deleted and their original value re-registered got to. However, for applications in a franking machine this kind of reserve storage is possible if you look at a few Write and read cycles limited, for example to the storage of security-relevant data for which the number on read and write cycles depending on postage usage is relatively small.

In the invention is as a reserve memory a ferroelectric memory is provided. At this Technology contain ferroelectric memory cells Material as a storage medium. The data are called states stored by storage capacitors. These storage capacitors form the memory cells of the ferroelectric Memory. In the static mode, the data is through defines the polarization state of the memory cells; in the dynamic operating mode, the data is considered the state of charge of the Memory cells mapped. The use of a ferroelectric Memory in connection with common other technologies for memory and non-volatile memory, for example battery-backed memory has the advantage that the simultaneous occurrence of write and read errors interfering signals due to different storage technologies is avoided.

A further development of the invention is characterized in that a Area of the reserve memory for storing a control program is provided. The reserve memory serves in this Case as read-only memory, which in this application at least partially replaced the usual ROM module. Through this training, the hardware effort for the Franking machine reduced. It is also possible to create an area of the reserve memory as working memory for the control to provide.

In order to avoid that when writing to the reserve memory, in which, in addition to the security-relevant data, the Control program is stored in prohibited areas Data is written that destroy the control program could be certain areas of the reserve memory read-only. In this read-only areas can the control program or other non-changeable Data are stored.

Figur 1

die Steuerung einer Frankiermaschine in einer Blockdarstellung, sowie

Figuren 2 und 3

die Ablaufschritte beim Einschalten des dynamischen Betriebs bzw. des statischen Betriebs des Reservespeichers.

An embodiment of the invention is explained below with reference to the drawing. It shows:

Figure 1

the control of a franking machine in a block representation, and

Figures 2 and 3

the process steps when switching on dynamic operation or static operation of the reserve memory.

In Figure 1, the controller 10 is the in a block diagram Postage meter shown. It contains a microprocessor 12 with a data bus 16 and an address bus 14 with a decoding unit 18, a working memory 20, a EPROM designed program memory 22, one as EEPROM trained memory for fixed data, a clock module 16 with a battery-backed first non-volatile memory 26, also as a battery-backed second non-volatile memory 28, as a ferroelectric reserve memory 30 trained third non-volatile memories, a further decoding unit 32, an interface module 34 for external units and an interface module 36 for a display and for input means electrical connected is. The two decoding units 18 and 32 are in summarized a customer-specific ASIC module 40. The Decoding unit 32 has lines 46, 46a, 46b which are connected to the Chip select inputs CS of the reserve memory 30, the memory 28 and the memory 26 are connected. Over these lines 46, 46a, 46b the memories 30, 28, 26 are selected, to read and write data. An output portl of the microprocessor 12 is via a control line 48 to the input D / NV of the reserve memory 30 connected. Depending on the signal on the control line 48, the reserve memory 30 in the operating mode "dynamic memory" or "static memory" switched.

In the first, second and third non-volatile memories 26, 28, 30 security-relevant data of the franking machine, for example the still available postage amount and the Postage amount already issued, each saved. The three non-volatile memories 26, 28, 30 operate according to different ones Technologies, so that high storage security also possible under unfavorable operating conditions is. The microprocessor 12 compares at certain time intervals those stored in the three memories 26, 28, 30 security-relevant data among each other. If the An error signal is generated from data from each other or it is causes an error correction, as for example in European patent application EP-A-0 572 019 is.

The microprocessor 12 is connected to a voltage monitoring module 42, which monitors the operating voltage U _B on the line 44. When the franking machine is in operation, the ferroelectric reserve memory 30 is operated with the same operating voltage U _B as the other components of the control system 10. The operation of the franking machine for franking mail using the components shown in FIG. 1 is known per se to the person skilled in the art and must be here not explained in more detail.

FIG. 2 shows in a flowchart the function of the reserve memory 30 when a drop in the supply voltage occurs and when the voltage returns. When the franking machine is switched on or when the supply voltage returns in step 50, the voltage monitoring module 42 reports to the microprocessor 12 that the operating voltage U _{B has been reached} , and in the subsequent step 52 the microprocessor 12 and the structural units connected to it are initialized, including the safety-relevant ones Data in memories 26 and 28 are compared for agreement. If it is determined in step 54 that the security-relevant data do not match, a branch is made to a further program in step 56, in which the error is corrected if necessary. For example, the method described in EP-A-0 572 019 can be used here.

If the security-relevant data is error-free, then in the subsequent step 58 the processing of interrupts (Events to which the microprocessor 12 responds and control functions triggers) interrupted in order to keep the Change the operating mode of the reserve memory 30 to be able to.

In the subsequent step 60, the reserve memory 30 is activated via the chip select line 46 by the decoding unit 32, and the microprocessor 12 sends a signal via the control line 48 to the input D / NV of the memory 30 to put it into the dynamic operating state to switch. In this dynamic operating state, the data 30 stored in the memory are continuously renewed. The renewal energy is supplied by the supply voltage U _B.

So-called dummy read cycles are subsequently stored in the memory carried out. These cycles are necessary for data storage, i.e. the polarization or charging of the Memory cells depending on the control signal 48 present to change.

In the subsequent step 64, the lock for the interrupt handling canceled. The microprocessor samples the signal of the voltage monitoring module 42. If not Power failure in step 66 becomes normal Postage meter operation (step 68) branches, and the usual Control functions are carried out.

If the voltage monitoring module 42 signals a drop in the supply voltage U _B , step 66 branches to program part A, the sequence of which is shown in FIG. 3. After the machine has been switched off or a supply voltage failure (step 70), the interrupt processing by the microprocessor 12 is blocked in the subsequent step 72. With the remaining electrical energy, for example buffered in a capacitor, the memory 30 is selected via the decoding module 32 and the line 46, and the microprocessor 12 outputs the signal for activating the non-volatile mode of operation of the memory 30 via the control line 48, so that this memory 30 switches to its static mode. In order to determine the memory content of the memory 30, the dummy read cycles already mentioned are carried out in the subsequent step 76. After the final voltage breakdown in step 78, the data in the memory 30 are stored statically. In this state, the memory 30 does not require a voltage supply. It is therefore possible to supply the memory 30 solely from the supply voltage U _B , from which the franking machine, with the exception of the battery-buffered memories 26, 28, also draw its electrical energy.

Claims (7)

1. Franking machine with an electronic controller (10) which accesses a first non-volatile memory (26, 28), in which safety-relevant data is stored and from which this data can be retrieved again,

   having at least one reserve memory (30),

   wherein with voltage failure the data of the first memory (26, 28) is stored in the reserve memory (30) and after voltage recovery this data can be read again from the reserve memory (30),

   the reserve memory is constructed as a ferroelectric memory (30) which can be operated selectively as static non-volatile memory or as dynamic volatile memory,

   the reserve memory (30) and the franking machine are supplied from a common supply voltage (U_B),

   and wherein the controller (10), upon drop of the supply voltage (U_B) to a specified value, sets the reserve memory (30) to the static operation and, with voltage recovery, to the dynamic operation, wherein to detect the drop of the supply voltage (U_B) a voltage monitor module (42) is provided, which compares the supply voltage (U_B) with a specified comparison value, and if it falls below the comparison value the module generates a signal for the controller (10) which switches the reserve memory (30) into the static operation by means of the emission of a control signal,

   characterized in that

   the first memory (26, 28) and the reserve memory (30) operate according to different techniques,

   in that the signal is an interrupt signal,

   in that the voltage monitor module (42) generates upon voltage recovery another interrupt signal for the controller (10) which switches the reserve memory (30) into the dynamic operation by means of a control signal,

   and in that before the connection of the static operation and the dynamic operation for the reserve memory (30) the processing of further interrupts is blocked.
2. Franking machine according to claim 1, characterized in that an area of the reserve memory (30) is provided for the storing of a control program.
3. Franking machine according to one of the preceding claims, characterized in that another area of the reserve memory (30) is provided as working memory for the controller (10).
4. Franking machine according to one of the preceding claims, characterized in that predetermined areas of the reserve memory (30) are write-protected.
5. Franking machine according to claim 4, characterized in that the memory area allocated to the control program is write-protected.
6. Franking machine according to one of the preceding claims, characterized in that the first memory (26 or 28) has a memory technique where it is voltage-backed by a battery or an accumulator.
7. Franking machine according to one of the preceding claims, characterized in that postage data of the franking machine, preferably the postage amount still available and the postage amount already issued, is stored in the reserve memory as safety-relevant data.

Images