EPM having an improvement in accounting update security

Abstract

An electronic postage meter has two non-volatile memories for storing postage meter accounting data under control of a CPU operating under a program in ROM. An accounting data recovery routine is stored in ROM. Prior to updating critical information in the non-valatile memories, a recovery address which calls the recovery program is stored in NVM and cleared after a successful update. At each power-up of the meter, the non-volatile memory is checked to see if the address is present and if it is, the accounting data is done again from the start of the accounting cycle.

Claims

What is claimed is:

1. A method for updating information in a non-volatile memory of a postage meter having a CPU, a ROM, and a non-volatile memory comprising the steps of providing a recovery program in the ROM, said ROM having a starting address for said recovery program, storing in the non-volatile memory prior to a update of non-volatile memory said address in said ROM, updating the information in said non-volatile memory, and clearing said address at the end of said information update, subsequently, upon a power-up of the electronic postage meter, checking said recovery address, and if said address is determined to be good, calling a recovery program at that address to reinitiate the information update process in the event that power was removed from the electronic postage meter during said information update.

2. The method in accordance to claim 1, wherein there are two non-volatile memories and further comprising the step of updating each non-volatile memory by providing a separate address for the recovery of each non-volatile memory.

3. The method in accordance with claim 1, wherein accounting operations for updating the non-volatile memories are carried out in scratch pad RAM and placed in buffers for transfer to said non-volatile memory.

4. An electronic postage meter having a non-volatile memory and a microprocessor for controlling the updates to non-volatile memory, the improvement comprising means for updating the non-volatile memory of the postage meter comprising:

a ROM, said ROM having a recovery program stored therein said ROM program having a start address;

means for storing in non-volatile memory prior to a update of non-volatile memory said address in said ROM;

means for updating the information in said non-volatile memory;

means for checking said recovery address upon a power-up of the electronic postage meter; and

means for calling a recovery program at that address to reinitiate the information update process in the event that power was removed from the electronic postage meter during said information update.

Description

RELATED APPLICATIONS

The following patent applications include material similar to that disclosed in the instant application: EPM HAVING AN IMPROVEMENT IN NON-VOLATILE STORAGE OF ACCOUNTING DATA, Ser. No. 282,194, filed Dec. 30, 1988, and EPM HAVING AN IMPROVEMENT IN NON-VOLATILE MEMORY ORGANIZATION, Ser. No. 282,195, Dec. 30, 1988.

1. Field of the Invention

The invention relates to electronic postage meters and more particularly to the storage of data in non-volatile memory in such electronic postage meters.

2. Background of the Invention

Electronic postage meters are well known. Such devices operate under microprocessor control to perform printing in accounting operations associated with the printing of a postal indicia on an envelope. Such accounting is usually carried out in a volatile memory and then transferred at a predetermined time to non-volatile memory for storage in the event that power is removed from the electronic postage meter.

Various techniques have been used to attempt to ensure that critical accounting data is not lost either because the data was not readable from non-volatile memory or that it is improperly transferred to non-volatile memory. U.S. Pat. No. 4,301,507 shows a system wherein the accounting data is transferred during the power-down sequence of the postage meter. U.S. Pat. No. 4,484,307 shows an accounting scheme where the data is computed and stored in battery-backed CMOS RAM which do not lose power when the power is removed from the electronic postage meter and thus retain the data.

McFiggans, U.S. Pat. No. 4,611,282, shows an alternative method of updating wherein flags are set in dependence upon the point in the routine which has been reached so that in the event of power-down, the read out of the flag at power-up will allow the accounting sequence to be completed from the point identified by the state of the flag. The flag information can be either stored in non-volatile memory in real-time or updated in the volatile memory and transferred to the non-volatile memory on power-down.

U.S. Pat. No. 3,321,747 of Adams, describes a mainframe computer process where upon the receipt of a power-down signal, an address is developed which upon a re-powering, allows the program to resume at the point the operation ceased or return to a particularly check point in the previous operations.

While all of the foregoing have been utilized, it has been found that transfers of any information during a power-down sequence in an electronic postage meter may be fraught with danger of data corruption since the voltages on the computer and memory modules may exhibit erratic behavior during this time. Additionally, the setting of a flag for each state of a complex operation may require a complex recovery program for continuing the operation from each point at which the flag is set in such a complex operation.

SUMMARY OF THE INVENTION

It is therefore an object of the invention to provide a method of updating the non-volatile memory so as to assure the proper transfer of data and to allow recovery of the accounting data from a redundant memory in the event that data is corrupted during an occurrence of power loss.

It is also an object of the invention to provide a secure update wherein upon a power failure during an accounting cycle, the accounting update returns to its start point under the control of addresses stored in non-volatile memory prior to the initiation of the update routine.

In accordance with the invention, there is provided a method for updating the non-volatile memories of a postage meter comprising the steps of providing a recovery program in ROM having a start address, storing in non-volatile memory prior to an update of non-volatile memory said address, updating the information in non-volatile memory, clearing the address from non-volatile memory, so that in the event that power is removed from the electronic postage meter during said information update, after power-up, the address is checked, and a routine associated with the recovery address is called to reinitiate the non-volatile memory update process.

Further features and advantages of the method and apparatus in accordance with the invention will be understood from the description in conjunction with the drawing.

BRIEF DESCRIPTION OF THE DRAWING

FIG. 1 is a perspective view of an electronic postage meter in which the invention may reside.

FIG. 2 is a schematic block diagram of the electronic postage meter.

FIG. 3 is a circuit diagram of the memory module in the electronic postage meter.

FIGS. 4A, 4B, 4C, and 4D comprise maps of non-volatile memory registers.

FIGS. 5A, 5B, 6-9, 10A, 10B, and 11 comprise a flow chart illustrating the postage meter accounting and non-volatile memory access routine in accordance with the invention.

FIG. 12 is the flow chart illustrating the accounting for a postage meter print operation.

FIGS. 13-14 comprise a flow chart illustrating the power up procedure of the non-volatile memories in accordance with the invention.

DESCRIPTION OF THE PREFERRED EMBODIMENT

In FIG. 1, there is shown an electronic postage meter at 10. The meter 10 may have a keyboard and display (not shown in this figure) suitably covered by a door or a sliding fixture (also not shown). The meter 10 is shown installed in position on a mailing machine 18. The mailing machine 18 includes, as schematically shown, a printing platen 20 driven by motor 22 which reciprocates platen 20, suitably via rack and pinion gears 24. The entire meter is suitably enclosed in the mailing machine by hinged cover 26. Feeder module 28 feeds mailpieces to the base 18 which in turn transports the mailpiece to the space between the print die 30 and the platen 20 where upon reciprocation of the platen an imprinted indicia is placed upon the mailpiece as shown on mailpiece 32 being ejected from the mailing machine 18.

Printwheels (not shown), set by stepping motors (also not shown), are arranged to print postage value on the envelope in conjunction with the remainder of the indicia. Further aspects of this meter are detailed in U.S. application Ser. No. 114,363, filed Oct. 27, 1987, now U.S. Pat. No. 4,876,956 entitled A REMOVABLE POSTAGE METER HAVING AN INDICIA COVER, assigned to the assignee of the present invention.

FIG. 2 is a circuit block diagram of the electronic postage meter. As seen in FIG. 2, the Central Processing Unit (CPU) 50, suitably a Model 8031 available from Intel, Santa Clara, Calif., receives its power from the power supply 52. The CPU 50 communicates address and data signals along with memory READ and WRITE signals in known manner to memory module 54 as well as to the decoder module 56. Read signals are transmitted to both on line 58 and WRITE signals on line 60, respectively. The multiplex address/data bus between the modules is shown at 62. Address bus 64 is also connected between the CPU 50 and memory module 54. The three highest order address lines 66, 68, and 70 are also connected to the decoder module 56. NVM READ and NVM WRITE signals are developed in the decoder module 56 under command of the CPU 50 and are connected to memory module 54 on lines and 74.

The decoder 56 receives a CPU reset signal from power supply 52 on line 76 and with suitable internal logical manipulation in combination with other developed signals in the decoder module 56 provides a CPU reset signal to CPU 50 on line 78. A suitable circuit for providing a reset signal dependent on power and voltage conditions in the power supply is shown, for example, in U.S. Pat. No. 4,547,853. A logic circuit for monitoring the reset from the power supply as well as other circuit parameters for developing a reset signal to the CPU is shown, for example in U.S. Pat. No. 4,747,057. A decoder chip is described in U.S. Pat. No. 4,710,882. As illustrated, the CPU 50 further communicates with LED drive module 80 to provide signals for the various sensors, the various stepper motor drivers (shown at 82) for positioning the postage meter printwheels (shown at 83), and solenoid drivers shown at 84 for controlling die-protector solenoids along lines 86, 88, and 90, respectively, through the decoder 56.

Keyboard display module 92 receives and displays information to the CPU 50 in conventional manner on line 94. Information is also provided from the keyboard of the keyboard/display module 92 to decoder 56 along line 96 in response to a strobe from the decoder 56 on line 97. External communications to the CPU are channelled through communication module 98 to the CPU on line 99. Typical features and the operation of postage meters are discussed, for example, in U.S. Pat. No. 4,301,507 and U.S. Pat. No. 4,484,307, both herein specifically incorporated by reference, and will not be further discussed.

FIG. 3 is a block diagram of the memory module 54 in the electronic postage meter. Memory module 54 comprises a Read Access Memory (ROM) 100 suitably Model 27C152 available from General Instruments, a CMOS random access memory (RAM) 102 such as Model number 62C64 available from NEC, a battery-backed RAM CMOS for non-volatile memory suitably Model number MK4802, available for example, from Mostek, at 104, and an E.sup.2 PROM device 106 suitably a Model 28C64 available, for example, from Atmel. For best results, the battery-backed RAM 104 is connected to receive voltages from batteries 108 and 110, each connected through diode 112 and 114, respectively, to the battery-backed RAM 104. Low order address data is furnished to each of the memories at input point 120 and is transmitted along connecting busses shown at 122, 124, 126, and 130. Multiplexed address and data are communicated to the module at input point 140 and communicated to the various memory devices along connecting busses shown at 142, 144, 146, and 148. The WRITE signal to RAM 102 is provided on line 150. A READ signal is sent along line 152 to both the RAM 102 and battery-backed RAM 104 on line 154. Non-volatile memory WRITE signal from the decoder 56 is provided at point 160 on lines 162 and 164. E.sup.2 PROM 106 is READ under control of the signal on line 170. Memory 102, 104, 106 are selected as required by chip enable signals on line 180.

For best results, data within the postage meter is stored in the two (2) non-volatile memory devices. Each device uses separate memory technology (CMOS and E.sup.2 PROM) to help guard against the possibility of a dual device failure or a bad manufacturing lot. All critical information within the system is maintained redundantly in both the CMOS battery-backed RAM 104 and the E.sup.2 PROM 106. In accordance with the invention any update of critical data within the CMOS non-volatile memory is immediately followed by a corresponding update or copy to the E.sup.2 PROM non-volatile memory. The redundancy allows data located in a "bad" section of either of the memories to be re-created from information in the alternate memory device as described below.

FIG. 4A and 4B are a map of the addresses of pertinent or buffers of CMOS battery backed memory 104 (FIG. 3), while FIGS. 4C and 4D are a map of the addresses of the registers of E.sup.2 PROM 106 (FIG. 3).

As seen in FIGS. 4A through 4D, each device is segmented into a set of data structures which are referred to herein as "stores". Each data store has one or more "buffers". Each buffer contains a set of one or more related data items. Thus, within a given store, each buffer will contain data items of the same type. The buffers within a given store are structurally identical, although the information content may vary between the buffers.

The storage of related data items means that the data needed, for instance, for calculation in a particular operation may be retrieved in a more simplified manner than has previously been the case.

Every data buffer is preferably fixed at 32 bytes in length. Even if the sum of the length of the data items in the store is less than 32 bytes, the remaining space will be unused. In accordance with the invention, each given data store uses either a "circular" or "ascending" buffer organization. If a data store uses a circular buffer organization, then prior to any update, an advance will be made to the next buffer in the store. After the last buffer in the store has been updated, the buffer pointer will loop back to the first buffer in the store.

Circular buffers are implemented for a store when either it is necessary to maintain a history on the data items in either the CMOS or the E.sup.2 PROM store or it is expected that the number of times that a given data item in the E.sup.2 PROM store will be updated could exceed the endurance level of the E.sup.2 PROM chip. It will be appreciated that in order to allow such a circular buffer organization, the data store must contain one (1) strictly increasing data item. This means that the value of this data item will increase each time a buffer is written to the store.

In accordance with the present invention, a data store will use an ascending buffer organization whenever a circular buffer is not required. For such an ascending buffer, advance to the next buffer is only made when there is a non-recoverable hardware failure within a current buffer address range. That is, there will be a no advance to the next buffer prior to an update of information.

For best results, each data buffer will have an attached cyclic redundancy code (CRC) calculated. A single CRC is computed across all of the data items within the buffer. If the buffer contains unused space, the CRC calculation does not include such unused bytes. It will be appreciated that the calculation of a single CRC for the entire buffer will save considerable space over that required for CRC's for each data item.

Each of the non-volatile memory devices 104 and 106 are divided into 32 byte segments. Each buffer begins on the segment boundary.

The lowest address space of each device is occupied by a bad segment data store. It will be understood that this data store could be located at other addresses as desired. This data store contains a bit map indicating good and bad segments within the device. Each segment of the device has a corresponding bit within the bad segment data store. This bit is turned on or off to indicate whether the corresponding segment can be used. For best results, each device maintains four (4) copies of the bit map for its own device only. That is, the copies of the CMOS bit map are stored only in the CMOS device and for the E.sup.2 PROM, the bit map copies are stored only in the E.sup.2 PROM device. The bit maps are seen in FIG. 4A at 200 and FIG. 4C at 300.

Each data store preferably has an entry in a ROM table. Table 1 in the Appendix hereto illustrates an example of such a ROM table. It contains information about data store characters. For each data store, the table contains information such as: organization, number of data bytes per buffer, beginning address of the store, ending address, the minimum number of segments which must be available in order for the system to continue reliable operation and whether the store resides in CMOS memory only or in both the CMOS and E.sup.2 PROM memories.

As discussed further below, for each data store, a pointer to the current buffer in that store is kept in RAM. These pointers are initialized at power up and are updated each time a buffer advance is necessary. Table 1 also shows these store definitions which contain the changing information about acceptable access to the memory structures.

As also seen in Table 1, each non-volatile memory data store suitably has a corresponding buffer in RAM for use when reading or writing to the devices. The buffers in the CMOS and E.sup.2 PROM NVMs shown in FIGS. 4A through 4D, indicate the postage meter trip information at 210 and 310, recovery information initialization 220 and 220', recharge information 230 and 330, error information 240, 245 and 340, configuration information 250 and 350 flags and device status 260 and 360, and data as to the parameters of the particular meter, 270 and 370. Additionally, there are a main and alternate store in CMOS memory for storing non-critical data (280 and 280') while in the E.sup.2 PROM there is a 2560 byte store for the Trip Count, shown at 380. The trip information includes 6 bytes of funds in the ascending register plus 5 bytes of funds in the descending register; the piece count has 4 bytes, batch count has 3 bytes, batch amount 6 bytes of funds, and the postage value set requires 3 bytes. The areas indicated at 290, 295, 390, 385, 393, and 395 are free space and store no data.

In addition to containing accounting information, each buffer in the accounting data store will also contain a pointer to a buffer in a circular "print counter" store in the E.sup.2 PROM. Preferably, this circular data store will be a least 2000 bytes in length and will be organized into 2 byte buffers. Each buffer contains 2 redundant counters. These counters will be incremented each time a print cycle occurs.

In accordance with the method for updating disclosed herein, the current value of the meter registers will not necessarily be directly readable from the E.sup.2 PROM. Rather, the meter register contents are calculated using data from both the accounting store and the print counter store in the E.sup.2 PROM. The calculations to be used in determining the register values are as follows:

    ______________________________________
    1.     ascending register value = ascending register
           value in data store +
           (postage value * print counter value)
    2.     descending register = descending register value
           in data store -
           (postage value * print counter value)
    3.     batch amount = batch amount +
           (postage value * print counter value)
    4.     piece count = piece count + print counter value
    5.     batch count = batch count + print counter value
    ______________________________________

• Inventors
  Brown, Nanette; Peterson, Sandra J.;
• Assignee
  Pitney Bowes Inc. (Stamford, CT)
• Published
  Jun-4-1991
• Current US Classes:
  705/405
  714/15
• Application #
  292181
• International Classes
  G07B 017/00
• Field of Search
  364/200 371/14 371/16 371/16.1
• Examiner
  Lall; Parshotam S.
• Agent
  Parks, Jr.; Charles G., Pitchenik; David E., Scolnick; Melvin J.
• US Patent References:
  4713769
  4747057
  4785417
  4812994
  4814971
  4916623