METHOD AND ARRANGEMENT FOR BACKUP OF CUSTOMER DATA STORED IN A FRANKING MACHINE

Abstract

In a method and an apparatus for transferring customer data stored in a non-volatile manner in a franking machine for backup purposes, a customer card is inserted in a card reader and a processor of the franking machine transfers data from a non-volatile memory in the franking machine to the customer card in the card reader.

Description

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention concerns an arrangement for transferring, for backup purposes changing of customer data that are stored in a non-volatile manner in a franking device of the type wherein client-dependent data (such as, for example, clichés and cost center data) are stored in a non-volatile manner in a memory of the franking device and must be saved from data loss in the case of repair. Such a franking device can be a commercial franking machine or a personal computer that is operated as a PC franker and that controls a commercial printer.

2. Description of the Prior Art

A postal fee billing system is known from German Published Application DE 39 03 718 A1 (corresponding to U.S. Pat. No. 5,111,030). Franking machine usage information is written to a chip card or read out therefrom. A transfer of data stored in first hardware to second hardware is, however, not possible in the case of defective hardware.

A method and apparatus for monitored controlled downloading of graphical images from a portable apparatus into a franking machine system is known from U.S. Pat. No. 6,085,180. For image data transfer, image data are stored in a portable device and are loaded in a controlled manner into a franking machine. The apparatus concerns only image data and is not connected to only one specific franking machine, i.e. the image data are not customer-specific.

A method and an arrangement for input of a printing stamp into a franking machine is known from the German Published Application DE 199 13 066 A1. In the franking machine of the type Jetmail® (manufacturer Francotyp Postalia GmbH), a preparation of a set of different country-specific and/or carrier-specific post stamp data ensues in a non-exchangeable memory of the franking machine in a first step and a configuration for a carrier and for a country in which the franking machine should be used ensues at the manufacturer in a second step. The configuration ensues by transmission of data by means of the integrated interface, in particular by means of a chip card via a chip card read/write unit of the franking machine. Data can be input into the franking machine in this manner. Either print images are transferred into the franking machine via an interface (for example chip card) or print images already present are selected for use. The data are not transferred from the franking machine to the chip card, and thus the chip card does not represent an updatable memory for print images.

An exchange of data without interconnected transfer means is known from the European Patent EP 560 714 B1 (corresponding to U.S. Pat. No. 5,509,117). To secure postal accounting data, a defective (old) installation unit is exchanged for a non-defective (new) installation unit, and the data of the old installation unit are transmitted to the new installation unit after both have been interconnected together via plug connectors. However, a data memory cannot be exchanged individually but rather only together with the installation unit.

A security module placed in a security region, the security module being plugged into the mainboard (motherboard) of the meter of the franking machine of the type JetMail® and that contains the accounting data, is known from the German design patent DE 200 20 635 U1. Other customer-dependent data (such as, for example, cliché and cost center data) are stored in a non-volatile manner in a separate memory of each franking machine. A franking machine of the type JetMail® has a meter assembly group and a base assembly group. The meter housing is fashioned as a security housing for protection of the mainboard. Since the battery-buffered memory units used in the meter still exhibit a DIP housing, they could be plugged into corresponding sockets on the mainboard and are therefore easily exchangeable in the case of repair. However, pluggable memory ICs (for example in a DIP housing) are problematic due to possible problems as to availability, lower capacity and limited expansion capability.

Such memories are no longer available with capacity sufficient for the subsequently developed franking machines. The exchange of defective mainboards is made more difficult by the transition from pluggable memory modules (DIP housing) to permanently soldered memory ICs in SOP, TSSOP or BGA housings since the customer-dependent data (for example cliché, cost centers) cannot be transferred from one mainboard to another without further measures. Although this transfer was still possible in the franking machine of the type JetMail® via a plugging of the battery-buffered memory, since memory in the DIP housing could still be used, for a franking machine of the type Ultimail software was created with whose help the data can be transferred from the franking machine into a service computer or personal computer (PC) via a serial data connection. The customer data thus can be changed in franking machines. If, for example, a defective mainboard of the franking machine must be exchanged for a new mainboard, the customer data are first transferred from the franking machine to a service computer via a serial data connection and then are copied from the service computer into the memory of the new mainboard after the mainboard exchange. However, this procedure cannot be applied in the case of a mainboard that is so defective that the data cannot be transferred from the service computer. In this case no data can be salvaged and an increased effort must be made in order to repair the franking machine.

SUMMARY OF THE INVENTION

An object of the present invention is to provide an arrangement for exchanging customer data that are stored in a non-volatile manner in franking devices wherein the customer data are transferable with relatively little effort from a defective mainboard to another, non-defective mainboard.

The object is achieved in accordance with the invention by an arrangement for exchanging customer data, wherein a customer card is provided that can be plugged into a socket of a franking device as a backup medium for customer-specific data used by the franking device. The socket is connected with corresponding connections (contacts) of a processor of the device in order to serially transfer the customer data via the socket and to store the data there in a non-volatile manner. The transfer ensues with a high speed via an assembly group for protection of the customer card from destruction by electrostatic discharge (ESD). These customer can be:

• • cost center data
  • advertising cliché data
  • SMS text data
  • abbreviated dialing data
  • optional printing: statistical data
  • optional printing: cliché data
  • class of mail data or also
  • postage table data

The use of a commercial memory card (such as, for example, MultiMedia Card (MMC)) as a customer data memory offers the following advantages:

• • Very high costs can be precluded relative to the costs in the development of an alternative module.
  • The management is unproblematical relative to that given the pluggable memory ICs (for example in a DIP housing) since ESD factors are considered. A relatively complicated infrastructure for reading and writing would also be necessary given a memory IC in a DIP housing.
  • A new development of a necessary infrastructure for reading/writing outside of the franking machine is no longer necessary.
  • The availability, manufacturing costs, development costs, manageability, capacity and its expandability of the module are approaching optimal:
    • Availability: MMCs are standardized and contained in many consumer products. The long-term availability is thereby provided. Given use of the MMC standard on the software driver level, a plurality of alternative manufacturers can be resorted to.
    • Manufacturing costs: The costs per Mbyte drop relatively steadily and quickly. One profits, so to speak, from the general development in the photo market and other technical fields.
    • Development costs: The development costs are relatively low. Modern processors (for example the Intel XScale) already possess an MMC controller on-chip. On the SW side, finished file systems for the employed operating system can be integrated. The development costs for the infrastructure are also low: the advantage here is the availability of commercial card reader devices. When a file system is used on the SW side, with a PC and a reader device standard Windows SW (Windows Explorer) can be used on the part of the service in order to read and to write to the MMC.
    • Manageability: Simple, and the card itself can be handled without ESD protection. A plurality of variants are conceivable with regard to the accessibility (accessible by the user or not).
    • Capacity and its expandability: The memory capacity of the smallest (still) customary MMC (32 Mbytes) is already more than sufficient for the considered usage purpose. The expandability of the capacity to more than 512 Mbytes is possible for new application cases.

The present invention also concerns a method for backing up customer data in a franking device wherein the data are backed up to a customer card, such as a MultiMedia Card (MMC).

DESCRIPTION OF THE DRAWINGS

FIG. 1 is a perspective view of a known franking machine of the type Jetmail® from the front right top.

FIG. 2 is a block diagram of the electronics of the franking machine of the type Jetmail®.

FIG. 3 is a block diagram of the electronics of an embodiment of a franking machine in accordance with the invention.

FIG. 4 illustrates stages of an exchange of the PSD and an MMC of a defective franking machine.

FIG. 5 is a perspective view of a franking machine in accordance with the present invention from the front right top.

FIG. 6 is a rear view of the new franking machine of FIG. 5.

FIG. 7 is a flowchart showing steps in the method according to the present invention for determining the machine state of a franking device in which a MultiMedia Card is used for backing up customer data.

FIG. 8 is a flowchart for recovery management that occurs after determining the machine state in accordance with the present invention.

FIG. 9 is a flowchart for evaluating whether data backup is needed after executing the recovery management routine in accordance with the present invention.

FIG. 10 schematically illustrates the action that is taken when case 1 is encountered in any of the routines shown in FIGS. 7, 8 and 9.

FIG. 11 schematically illustrates the action that is taken when case 2 is encountered in any of the routines shown in FIGS. 7, 8 and 9.

FIG. 12 schematically illustrates the action that is taken when case 3 is encountered in any of the routines shown in FIGS. 7, 8 and 9.

FIG. 13 schematically illustrates the action that is taken when case 4 is encountered in any of the routines shown in FIGS. 7, 8 and 9.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

A perspective view of a known franking machine of the type Jetmail® from the front right top is shown in FIG. 1. In a basic version the franking machine JetMail® includes the assembly groups meter 10*, Base 20* and tray 40*. The meter 10* has on the top side a user interface with a display unit and a keypad. A security module and battery-buffered memory are plugged into the mainboard (not visible) within the meter, which has a security housing. The meter 10* is fashioned such that it can be removed from the base 20* and then is accessible from its floor, assuming a repair. If a defective meter 10* is removed, before it is scrapped, the battery-buffered memory and the security module are extracted and then plugged into the mainboard of a second (new) meter. The new meter is subsequently installed.

A block diagram of the electronics of the franking machine of the type Jetmail® is shown in FIG. 2. A processor 1* on the mainboard 11* is connected (in terms of data, control and addressing) with an external interface 13* via a driver 12* and via a bus 5* with a socketed battery-buffered memory (NVRAM) 6*, with a postal security module (PSD) 7*, with a static RAM as a volatile working memory 8* and with a program memory (Flash) 9*. The NVRAM 6* serves for the storage of customer-specific data and therefore has a correspondingly large memory capacity. The PSD and the NVRAM 6* are plugged into respective corresponding sockets of the mainboard 11* of the meter 10*. The external interface 13* is a chip card read/write unit.

FIG. 3 shows a block diagram of the electronics of a franking machine in accordance with the invention corresponds with the basic design shown in FIG. 1 with the following differences. The integration of an MMC 4 into the electronics (assembly groups 1 through 9) of the mainboard 11 of a franking machine can be realized without a problem when modern processors 1 are used that already possess an MMC controller on-chip. The assembly group MMC socket 3 has a sufficient protection from destruction by electrostatic discharge (ESD) via a corresponding assembly group 2. Electromagnetic compatibility (EMV) and signal integrity factors can therewith be taken into account since the data transfer rate is up to 20 MHz. The data transfer rate is therewith more than an order of magnitude above that data transfer rate that is customary with chip cards.

Primarily the corresponding port pins of the processor 1 are connected with the MMC socket 3 via the ESD protection assembly group 2. Furthermore, via drivers 12 an interface 13 can optionally be enabled at the processor 1, for example a chip card read/write unit. The connections and the aforementioned optional assembly groups are marked with dash-dot lines.

The customer card MMC 4 is used as a backup medium for customer-specific data (cost center data, cliché data, optional print cliché data, class-of-mail data and postage table data as well as SMS-like short texts, abbreviated dialing and optional printing: statistics). In slower franking machines the processor is operated programmed by a first program stored in the program memory (flash) 9 such that altered data can be directly updated on the customer card MMC 4.

However, when the franking machine is a high-capacity franking system, all customer data cannot be immediately written to the customer card after each letter. The processor 1 is connected (in terms of operation) with a non-volatile memory (NVRAM) 6 permanently soldered onto the mainboard 11, which non-volatile memory 6 exhibits a low storage capacity, and said processor 1 is operated programmed by a second program stored in the program memory (flash) 9 such that, for example, the currently set cost center is loaded into the NVRAM 6 before the current data are stored in this NVRAM 6. The data are updated on the customer card in time intervals, for example when a print pause is achieved or the machine was just activated or deactivated. The process is correspondingly programmed for this. This method is distinctly quicker since the current altered data are transferred in parallel from the bus 5 and are buffered in the non-volatile memory (NVRAM) 6 between the time intervals.

Stages of an exchange of the PSDs and an MMC of a defective franking machine are shown in FIG. 4. At a first point a first defective franking machine FM A is shown from which a PSD 7 and an MMC 4 (which are shown at a second point) are taken. The PSD 7 contains accounting/billing data and the MMC 4 contains the customer data. A second, non-defective franking machine FM B into which the extracted PSD 7 and MMC 4 were inserted is shown at a third point.

FIG. 5 shows a perspective view of the inventive franking machine FM A from the front right above. In contrast to the franking machine of the type Jetmail®, no meter/base separation exists. The electronic components (likewise MMC and PSD) are arranged within the security housing of the new franking machine. After opening the security housing, the plugged assembly groups (customer card (MMC) and security module (PSD)) can be exchanged quickly.

An optional chip card 50 can be plugged into a chip card write/read unit that is arranged such that is accessible on the left half of the housing top 23 of the franking machine, behind a protective panel 21. The franking machine can be equipped with an automated sealer 30 (shown) and further mail stations (not shown) such as, for example, with an automatic feed in the periphery.

A rear view of the new franking machine FM A is shown in FIG. 6 from the rear, left, above, from which franking machine FM A the housing of the rear side has been removed. The components MMC 4 and PSD 7 are visible through this and through a section in a covering, which components are arranged near the rear wall of the new franking machine on the mainboard.

An envelope (not shown) or another mail piece standing on edge can be transported in a shaft that is bounded on its sides by the protective panel 21 and a guide plate 22. The printing of the mail piece with a franking stamp image ensues without contact by means of inkjet technology during the mail piece transport. The billing or accounting data are cryptographically secured with keys from the PSD.

The non-volatile memory 6 arranged on the mainboard 11 of the franking machine is, for example, a battery-buffered NVRAM. As an alternative to this, other non-volatile memory technologies (FRAM, NVSRAM) can also be used.

The MMC is operationally connected with the processor. Solutions are also conceivable in which a programmable logic (such as, for example, a Spartan-II 2.5V FPGA from the company XILINX or an application-specific integrated circuit (ASIC)) is connected in-between.

In a further embodiments of the invention, the customer data are also cryptographically secured with keys from the PSD. The encrypted customer data can additionally comprise an association of the customer data with the serial number of the PSD.

An MMC with customer data can also be plugged into a personal computer PC when the PC exhibits a corresponding interface. The security module which is designated for use in postal apparatuses can also exhibit a different design that enables it to be plugged into the mainboard of a personal computer, for example, to allow the personal computer to be operated as a PC franker and control a commercial printer.

A procedure for backing up customer data stored in a franking machine, making use of an MMC in a card reader of the franking machine is shown in the flowcharts of FIGS. 7-13.

FIG. 7 illustrates a procedure that is executed before state determination, namely before the determination of the machine state. A number of checks is performed to ensure that the system is functioning properly. In FIG. 7, as well as in FIGS. 8 and 9, exit possibilities 1, 2, 3 and 4 are indicated in circles, the results of those exit possibilities being respectively shown in FIGS. 10, 11, 12 and 13. Exit case 1 can be considered to be a normal startup, exit case 2 is a startup into the service mode, exit case 3 represents an MMC defect, and exit case 4 is an emergency shutdown.

The portion of the procedure illustrated in FIG. 7 starts in step 60 and checks, in step 61, whether the mainboard data are correct. If not, exit to the case 4 situation occurs. If the mainboard data are determined to be correct, a check is made in step 62 as to whether a recovery is in progress. If not, again an exit to case 4 is made. If so, a check is made in step 63 as to whether a security device is present. If not, the routine exits to case 2. If it is determined that a security device is present, a check is made in 64 as to whether the MMC is present. If not, the routine exits to case 3. If the MMC is present, a check is made in step 65 as to whether the MMC format is correct. If not, an exit to case 3 is made. If the MMC format is correct, an MMC checkdisk subroutine is executed, and if a “not recoverable” result occurs, and exit to case 3 is made. If the MMC checkdisk subroutine executes properly, a check is made in step 67 as to whether the OEM information is correct. If not, an exit to case 3 is made. If the OEM information is correct, then in step 68 the machine state is determined, as are the applicable case and any action that needs to be taken, as exemplified by the procedure illustrated in the flowchart of FIG. 8.

FIG. 8 begins with the same ending step 68 from FIG. 7 that is designated step 70 in FIG. 8. The routine shown in FIG. 8 then proceeds to step 71, wherein it is determined whether the machine state has changed. If so, the appropriate case among case 1, case 2 or case 3 is exited to, and appropriate information is displayed in step 72. If the machine state has not changed, an inquiry is made in step 73 as to whether an action is required. If not, the routine exits to case 1. If an action is required, an inquiry is made in step 74 as to whether the state is invalid. If not, an exit to case 4 is made. If yes, the routine proceeds to step 75 wherein an inquiry is made as to whether the access level is sufficient. If not, the routine exits to case 4. If the access level is sufficient, a check is made in step 76 as to whether initialization is required. If so, the routine proceeds to step 77, wherein the MMC is initialized. If no initialization is required, an inquiry is made in step 78 as to whether the MMC lifetime has been exceeded. If so, the routine exits to case 3. If not, in step 79 a backup is initiated.

FIG. 9 shows the remainder of the procedure in a flowchart that begins with the same step as the ending step in FIG. 8, designated step 80 in FIG. 9. Following step 80, an inquiry is made as to whether a backup is in progress. If not, it is checked in step 82 whether a backup exists. If so, and if a backup is in progress, it is determined in step 82a whether to proceed. In step 83, it is determined whether the machine is in case 2, and if so the dobackup routine is run. If this is unsuccessful in step 83a, the routine proceeds to step 84 wherein it is again determined whether backup is needed, and if so a check is made in step 84a to use exiting or available backup data in step 84 or to create new backup data in step 84c.

In step 85, it is checked whether the startup is normal with no errors, and if so the backup data are tested in step 85a. If the startup is not normal or if errors are detected in step 85, then in step 86 an inquiry is made as to whether any recovery action is needed. If so, the data are recovered in step 86a. If not, a check is made as to whether any defect in the MMC exists, and if not the routine exits to case 3, and if so the routine exits to case 1.

The results of the respective exit cases are shown in FIGS. 10-13. As schematically indicated in FIG. 10, the result of exit case 1 is normal startup in step 90. The result of exit case 2 is startup in a service mode in step 91. The result of exit case 3 is to mark or otherwise indicate the MMC as being defective in step 92, and to display appropriate information in step 93, followed by an exit to case 1. Exit case 4 proceeds in step 94 with a display of appropriate information and a shutdown of the franking machine in step 96.

Although modifications and changes may be suggested by those skilled in the art, it is the intention of the inventors to embody within the patent warranted hereon all changes and modifications as reasonably and properly come within the scope of their contribution to the art.

Claims

1. An arrangement for backing up customer data that are stored in a non-volatile memory in franking device, comprising: a processor in communication with said memory; a card reader having a card receptacle in communication with said processor; a customer card having a non-volatile data storage region, said customer card being received in said card receptacle of said card reader; and said processor serially transferring said customer data from said non-volatile memory to said non-volatile memory region of said customer card.

2. An arrangement as claimed in claim 1 wherein said customer card is a commercial memory card.

3. An arrangement as claimed in claim 2 wherein said customer card is a MultiMedia Card.

4. An arrangement as claimed in claim 1 wherein said franking device is selected from the group consisting of franking machines and personal computers operable as a PC franker, and wherein said processor controls a commercially-available printer to perform franking functions therewith.

5. An arrangement as claimed in claim 4 comprising an ESD protection assembly group connecting said card receptacle with said processor.

6. An arrangement as claimed in claim 1 comprising a program memory with a program stored therein that is accessible by said processor, said program programming said processor to cause any altered data to be directly updated on said customer card.

7. An arrangement as claimed in claim 1 wherein said program in said program memory is a first program, and wherein said program memory contains a second program that operates said processor to cause altered data to be updated on the customer card at respective time intervals, and for current altered data to be stored in said non-volatile memory between said time intervals.

8. An arrangement as claimed in claim 7 wherein said processor updates said data on said customer card at a time selected from the group consisting of a printing pause, activation of said franking device, and deactivation of said franking device.

9. A method for backing up customer data that are stored in a non-volatile memory in franking device, comprising: placing a processor in communication with said memory; placing a customer card having a non-volatile data storage region in a card receptacle of a card reader; and via said processor, automatically serially transferring said customer data from said non-volatile memory to said non-volatile memory region of said customer card.

10. A method as claimed in claim 9 comprising employing a commercial memory card as said customer card.

11. A method as claimed in claim 10 comprising employing a MultiMedia Card as said customer card.

12. A method as claimed in claim 9 wherein said franking device is selected from the group consisting of franking machines and personal computers operable as a PC franker, and comprising from said processor, controlling a commercially-available printer to perform franking functions therewith.

13. A method as claimed in claim 12 comprising connecting said card receptacle with said processor through an ESD protection assembly group.

14. A method as claimed in claim 9 comprising storing a program in a program memory that is acceptable by said processor, and with said program, programming said processor to cause any altered data to be directly updated on said customer card.

15. A method as claimed in claim 9 wherein said program in said program memory is a first program, and comprising storing a second program in said program memory, and with said second program, programming said processor to cause altered data to be updated on the customer card at respective time intervals, and for current altered data to be stored in said non-volatile memory between said time intervals.

16. A method as claimed in claim 15 comprising, with said processor, updating said data on said customer card at a time selected from the group consisting of a printing pause, activation of said franking device, and deactivation of said franking device.