Electronic postage meter having improved security and fault tolerance features

Abstract

A microcomputerized postage meter that provides high degrees of security and fault tolerance. The meter maintains data security under low power conditions by the use of functionally nonvolatile memory units. Register and other data which must survive normal and abnormal losses of power to the meter electronics are stored in dual redundant battery augmented memories (hereinafter designated BAMs). Upon detecting an error condition, the microcomputer writes an appropriate fault code to the BAMs. A mechanism for disabling the meter includes dual redundant flip-flops which are set to a "faulted" state upon detection by the microcomputer of a failure condition. These flip-flops are powered by the BAM batteries. They cannot be reset except by physical access to the meter interior, which access is only available to authorized personnel at the factory. The fault flip-flops are also set when the microcomputer fails to properly execute its own operating program. Once the meter has been set to a "faulted" state, the fault flip-flops hold two signals, MPCLR ans SYSCLR, true. The BAM contents may still be read out independently of the microcomputer which is prevented from accessing the BAMs. This is accomplished by allowing power necessary to read the BAMs to be supplied to the BAMs without supplying power to the microcomputer. Moreover, even if the microcomputer is powered, MPCLR prevents it from executing instructions and SYSCLR isolates it.

Claims

We claim:

1. In a microcomputerized postage meter having a microcomputer programmed for supervising the printing operation and for generating, maintaining, and verifying accounting information, a postage printing mechanism coupled to the microcomputer for printing postage in response to instructions from the microcomputer, and input means coupled to the microcomputer for communicating data to the microcomputer, the microcomputer and printing mechanism being located within a secure housing, the improvement comprising:

first and second independent non-volatile memory means coupled to the microcomputer and located within the secure housing;

the programmed microcomputer including means for storing a particular item of accounting information in each of corresponding locations of the first and second non-volatile memory means, means for retrieving the contents of the corresponding locations, and means for comparing the contents of the corresponding locations; and

non-user-resettable means coupled to the microcomputer for deactivating the meter in response to a disagreement between the contents of the corresponding locations, the non-user-resettable means for deactivating the meter being located within the secure housing, and, once set, being beyond control of the microcomputer;

the non-user-resettable means for deactivating the meter having associated means coupled to the first and second non-volatile memory means for preventing the microcomputer from writing data into either of the first and second non-volatile memory means and associated means coupled to the postage printing mechanism for preventing activation of the postage printing mechanism.

2. The invention of claim 1, and further comprising an alternate communication path coupled to the first and second non-volatile memory means to enable the external retrieval of the contents of the corresponding locations independently of the microcomputer after the meter has been deactivated.

3. The invention of claim 1 wherein the microcomputer further includes

means responsive to the disagreement between the contents of the corresponding locations for storing a failure code representative of such disagreement in the first non-volatile memory means prior to the time that the non-user-resettable means for deactivating the meter acts to deactivate the meter.

4. In a microcomputerized postage meter having a microcomputer, a postage printing mechanism coupled to the microcomputer for printing postage in response to instructions from the microcomputer, and input means coupled to the microcomputer for communicating data to the microcomputer, the microcomputer and printing mechanism being located in a secure housing, the improvement comprising:

first and second independent non-volatile memory means coupled to the microcomputer and located within the secure housing;

the programmed microcomputer having means for generating a set of accounting information items, the values of which items have an internal arithmetic relationship to one another irrespective of their individual values, means for writing the set of accounting items into each of corresponding pluralities of locations in the first and second non-volatile memory means, means for retrieving the contents of the corresponding pluralities of locations, and means for comparing the contents of the corresponding pluralities of locations;

non-user-resettable means coupled to the microcomputer for deactivating the meter in response to a disagreement between the contents of the corresponding pluralities of locations, the non-user-resettable means for deactivating the meter being located within the secure housing, and, once set, being beyond control of the microcomputer;

the non-user-resettable means for deactivating the meter having associated means coupled to the first and second non-volatile memory means for preventing the microcomputer from writing data into either of the first and second non-volatile memory means and associated means coupled to the postage printing mechanism for preventing activation of the postage printing mechanism; and

an alternate communication path coupled to the first and second non-volatile memory means to enable the external retrieval of the contents of the corresponding pluralities of locations independently of the microcomputer to facilitate possible reconstruction of the correct values of the accounting items.

5. The invention of claim 4 wherein each of the first and second non-volatile memory means includes read enabling means requiring designated voltage inputs, and also comprising an alternate power path to permit the designated voltage inputs to be supplied by an alternate power supply independently of the power for the microcomputer.

6. The invention of claim 4 wherein the microcomputer further includes

means responsive to the disagreement between the contents of the corresponding pluralities of locations for storing a failure code representative of such disagreement in the first non-volatile memory means prior to the time that the non-user-resettable means for deactivating the meter acts to deactivate the meter.

7. In a microcomputerized postage meter having a microcomputer, a postage printing mechanism coupled to the microcomputer for printing postage in response to instructions from the microcomputer, and input means coupled to the microcomputer for communicating value setting and print initiation signals to the microcomputer, the improvement comprising:

a non-volatile memory system including first, second, and third non-volatile memory means coupled to the microcomputer, the first, second, and third non-volatile memory means having respective first, second, and third pluralities of locations, at least the first and second non-volatile memory means being independent of one another;

the programmed microcomputer having

means for generating a set of accounting information items, the values of which items have an internal arithmetic relationship to one another irrespective of their individual values,

means for storing the set of accounting information items in corresponding locations of the first and second pluralities of locations,

means for storing the set of accounting information items in the third plurality of locations,

means for changing the values of at least two of the items stored in the third plurality of locations in response to a value setting signal from the input means, the values of the items stored in the third plurality of locations including the changed values, maintaining the same internal arithmetic relationship, and

means for copying the changed values into the first and second pluralities of locations when the postage printing mechanism is activated in response to a print initiation signal from the input means.

8. The invention of claim 7 wherein the first and third non-volatile memory means are physically within the same memory chip.

9. In a microcomputerized postage meter having a microcomputer operable according to a program for supervising the printing operation and for generating, maintaining, and verifying accounting information, postage printing means coupled to the microcomputer for printing postage in response to instructions from the microcomputer, and input means coupled to the microcomputer for communicating data to the microcomputer, the improvement comprising:

first and second independent non-volatile memory means coupled to the microcomputer;

monostable multivibrator means having a trigger input and an output, the multivibrator means being operable to maintain the multivibrator output at a first logic level for a predetermined time in response to a triggering signal at the trigger input and to allow the multivibrator output to assume a second logic level distinct from the first logic level when the predetermined time elapses without a triggering signal at the trigger input;

non-user-resettable means coupled to the multivibrator output for deactivating the meter in response to the appearance of the second logic level on the multivibrator output, the non-user-resettable means for deactivating the meter, once set, being beyond control of the microcomputer and operating to prevent the microcomputer from writing data into either of the first and second non-volatile memory means and to prevent activation of the postage printing mechanism; and

means associated with the microcomputer and coupled to the trigger input for repeatedly generating a triggering signal at intervals substantially less than the predetermined time during operation of the meter;

the programmed microcomputer having means for detecting a failure condition, means for generating a failure code representative of the type of failure, means for suppressing the triggering signal generating means in response to the detection of a failure condition such that the detection of a failure causes the multivibrator output subsequently to assume the second logic level, whereupon the meter becomes deactivated, and means for storing the failure code in the first and second non-volatile memory means prior to the time that the multivibrator output assumes the second logic level.

10. The invention of claim 9 wherein the non-user-resettable means for deactivating the meter comprises bistable second multivibrator means having an input coupled to the output of the monostable first-mentioned multivibrator means.

11. In a microcomputerized postage meter having a microcomputer, and input means coupled to the microcomputer for generating signals representative of the value of postage to be printed, the improvement comprising:

a print head including a print element having postage printing indicia formed thereon and being capable of assuming any one of a plurality of serially disposed positions, the print head being capable of assuming a home position in which printing is impossible;

stepping motor means coupled to the print element, the stepping motor means having a plurality of positions corresponding to the plurality of print element positions;

motor driving means coupled to the microcomputer for driving the stepping motor means from a first of the plurality of positions to a second serially adjacent one of the plurality of positions;

position indicator means coupled to the microcomputer for generating and communicating to the microcomputer an electrical signal representative of the position of the stepping motor means;

print head sensor means coupled to the microcomputer for generating and communicating to the microcomputer an electrical signal respresentative of whether the print head is in its home position;

means associated with the microcomputer for activating the motor driving means to effect positioning of the print element;

means associated with the microcomputer and responsive to the position indicator means for determining whether the stepping motor means has moved from the first position to the second position within a predetermined time interval;

means for suspending operation of the meter in response to a determination that the stepping motor means has not moved from the first position to the second position within the fixed time interval;

means associated with the microcomputer and responsive to the print head sensor means for determining whether the print head has left its home position prior to completion of the positioning of the print element; and

non-user-resettable means coupled to the microcomputer for deactivating the meter in response to the determination that the print head has left its home position prior to completion of the positioning of the print element.

12. In a microcomputerized postage meter having a microcomputer, a postage printing mechanism coupled to the microcomputer for printing postage in response to instructions from the microcomputer, and input means coupled to the microcomputer for communicating data to the microcomputer, the microcomputer and the printing mechanism being located in a secure housing, the improvement comprising:

non-volatile memory means coupled to the microcomputer, including a plurality of memory locations for storing a set of accounting information items;

bistable multivibrator means including self-contained power supply means and having an output capable of assuming first and second distinct logic levels in response to first and second respective states of the bistable multivibrator means, the bistable multivibrator means, once in the second state, being beyond the control of the microcomputer and being resettable to the first state only by physical access to the interior of the secure housing;

means associated with the microcomputer for detecting a failure condition;

means associated with the microcomputer and coupled to the bistable multivibrator means for causing the bistable multivibrator means to assume its second state in response to the detection of a failure condition;

power surveillance means for generating a power loss signal in response to a low power condition;

means responsive to the power loss signal for generating a system clear signal;

means responsive to the system clear signal for preventing the microcomputer from writing data into the non-volatile memory means;

means responsive to the system clear signal for preventing activation of the printing mechanism; and

means responsive to the logic level of the bistable multivibrator output for maintaining the system clear signal active in response to the appearance of the second logic level regardless of the state of the power loss signal.

13. The invention of claim 12, and further comprising:

means responsive to the power loss signal for generating a microcomputer clear signal; and

means responsive to the microcomputer clear signal for disabling the microcomputer;

wherein the means for maintaining the system clear signal active also operates to maintain the microcomputer clear signal active.

14. The invention of claim 12 wherein the means for causing the bistable multivibrator means to assume its second state comprises:

a retriggerable one-shot;

means associated with the microcomputer and coupled to the one-shot for repeatedly triggering the one-shot at intervals less than a predetermined time to maintain the one-shot in a first state during operation of the meter; and

means associated with the microcomputer for suppressing the triggering in response to the detection of a failure condition to allow the one-shot to assume a second state.

15. The invention of claim 1 or 4 wherein the non-user-resettable means for deactivating the meter, the associated means for preventing the microcomputer from writing, and the associated means for preventing activation of the postage printing mechanism together comprise:

bistable multivibrator means including self-contained power supply means and having an output capable of assuming first and second distinct logic levels in response to first and second respective states of the bistable multivibrator means, the bistable multivibrator means, once in the second state, being resettable to the first state only by physical access to the interior of the secure housing;

means associated with the microcomputer for causing the bistable multivibrator means to assume its second state in response to the disagreement;

means responsive to the logic level of the bistable multivibrator output for generating a system clear signal in response to the appearance of the second logic level on the bistable multivibrator means output;

means responsive to the system clear signal for preventing the microcomputer from writing data into either of the first and second non-volatile memory means;

means responsive to the system clear signal for preventing activation of the printing mechanism;

means responsive to the appearance of the second logic level on the bistable multivibrator output for generating a microcomputer clear signal; and

means responsive to the microcomputer clear signal for disabling the microcomputer.

16. The invention of claim 15, and further comprising:

power surveillance means for generating a power loss signal in response to a low power condition;

the means for generating the system clear signal and the means for generating the microcomputer clear signal being further responsive to the power loss signal.

17. The invention of claim 1 or 4, and further comprising power surveillance means for generating a power loss signal in response to a low power condition, and wherein the non-user resettable means for deactivating the meter, the associated means for preventing the microcomputer from writing, and the associated means for preventing activation of the postage printing mechanism together comprise:

means responsive to the power loss signal for generating a system clear signal and a microcomputer clear signal;

means responsive to the system clear signal for preventing the microcomputer from writing data into either of the first and second non-volatile memory means when the system clear signal is active;

means responsive to the system clear signal for preventing activation of the printing mechanism when the system clear signal is active;

means responsive to the microcomputer clear signal for disabling the microcomputer when the microcomputer clear signal is active;

the system clear and microcomputer clear signals being relatively timed to ensure microcomputer operation during activation of the printing mechanism; and

means for maintaining the system clear signal active in response to the disagreement, regardless of the state of the power loss signal.

18. The invention of claim 15 wherein the non-volatile memory means includes read enabling means requiring designated voltage inputs, and further comprising an alternate power path to permit the designated voltage inputs to be supplied by an alternate power supply independently of the power for the microcomputer.

19. The invention of claim 1 or 4 or 7 wherein each of the first and second non-volatile memory means includes a CMOS memory and a battery.

20. The invention of claim 4 or 7 wherein the set of accounting information items includes an ascending balance, a descending balance, and a control total, and wherein the internal arithmetic relationship is that the sum of the ascending and descending balances equals the control total.

21. The invention of claim 1 or 4 or 9 wherein the non-user-resettable means for deactivating the meter also operates to prevent further operation of the microcomputer.

Description

FIELD OF THE INVENTION

The present invention relates to a microcomputerized postage meter.

BACKGROUND OF THE INVENTION

Postage meters (hereinafter sometimes designated simply as "meters") are well-known devices for imprinting postage impressions of desired value either on a gummed tape or directly on an article to be mailed, thereby obviating the need to use postage stamps. Due to their convenience and flexibility, meters have found widespread use in commerce.

A postage meter normally includes a postage selection mechanism, a postage printing mechanism, and a plurality of internal registers for maintaining accounting information. The internal registers most commonly contain numerical values representative of the total postage paid for (control total), the total postage printed (ascending balance or ascending register), and the total postage remaining (descending balance or descending register). The information contained in the internal registers is redundant, since the ascending balance and descending balance normally sum to the control total.

Prior to using the meter a user must buy from a postal service employee a fixed amount of postage. (In this connection, the term "postal service" may refer to either a public or private mail carrying entity.) The postal service employee alters the contents of the internal registers to reflect the amount of postage paid by increasing the control total and the descending balance by this amount. To use the meter, the user first selects a value of postage to be printed, and then activates the printing mechanism. The meter may be used until the descending balance reaches a predetermined minimum (e.g., until the postage paid for has been exhausted or has reached a minimum threshold value).

It can immediately be seen that postage meters are subject to stringent security requirements to ensure that all postage actually printed has been paid for. Thus, the level of security can be measured by the difficulty of activating the meter'printing mechanism without correspondingly updating the accounting registers within the meter, and also by the difficulty of altering or losing the meter register values, whether intentionally, inadvertently, or accidentally. To this end, the print mechanism and the accounting registers are located within a secure housing, and access thereto is restricted to postal service employees.

Postage meters have traditionally been essentially mechanical devices whose mechanical design is relatively complicated due to the need to correlate operation of the postage selection mechanism, the postage printing mechanism, and the registers. In parcticular, the print mechanism must print a postage value corresponding to the value set by the user, and the appropriate internal registers must be changed by this amount. Moreover, the meter must be interlocked to disable the print mechanism when the descending balance reaches the predetermined minimum level, and to prevent more than a single printing impression from being made during a cycle of the printing mechanism. Mechanisms capable of performing these functions, of necessity, contain a large number of mechanical parts, and therefore require considerable periodic maintenance. While several decades of experience have resulted in the design and implementation of acceptably reliable mechanical postage meters, such devices have still tended to be expensive, heavy, bulky, and slow.

Recent advances in the electronic arts have suggested the desirability of replacing many of the mechanical components in a postage meter with electronic components. Thus, it is known in the prior art to provide a first-generation electronic postage meter employing discrete logic components. Such a meter is shown in U.S. Pat. No. 3,938,095 to check, Jr. et al.

By their nature, electronic postage meters rely heavily on continuous electric power during operation. However, frequent power loss of either a momentary or prolonged nature is to be expected. While power loss is not a particularly significant event for mechanical meters, it poses two distinct threats to the security of electronic postage meters. First, power loss presents a threat to the integrity of the register data which is typically stored in electronic memory units, since most electronic memories are volatile devices (i.e., they require continuous electric power to maintain their contents). This is to be contrasted with mechanical registers which are inherently nonvolatile devices. Second, the various correlation and interlocking functions are performed by electronic logic components, the performance of which can become unpredictable during a low power condition. Since this could lead to improper updating of registers, and the like, there must be provided a reliable mechanism wherein the electronic circuitry inhibits meter functioning when a low power condition is sensed. Moreover, this inhibiting must occur before the power falls to a level at which the electronic circuitry becomes unreliable.

In addition to the security requirements discussed above, a second requirement of postage meters, called "fault tolerance", comes into play when mechanical registers and other functions are replaced by electronic components. Fault tolerance refers to the meter's ability to maintain security in view of individual component failure. A postage meter is likely to be used in a variety of settings that may subject the components to environmental rigors such as mechanical shock, stray electric fields, and wide temperature variations, any of which may cause an electronic, mechanical, or electromechanical component to fail.

It is apparent that the large number of components in the first-generation electronic postage meters employing discrete logic elements (i.e., transistors, diodes, etc.) tends to render such meters insufficiently reliable for postal service approval. A further difficulty with electronic postage meters employing discrete logic components is that the features and capabilities of the meter cannot be altered easily once the meter is constructed. Thus, like their mechanical counterparts, such meters cannot readily be adapted to new applications.

In recognition of the above problems, first-generation electronic postage meters employing discrete logic have given way to second-generation electronic postage meters employing large scale integration microcomputer architecture. An example of such a second-generation stand-alone postage meter is disclosed in U.S. Pat. No. 3,978,457 to Check, Jr. et al., employing a microcomputer system which monitors the printing and other functions of the meter, and which supervises and maintains the required accounting information. A microcomputerized postage meter contains a smaller number of components than its discrete component counterpart, and is therefore likely to have improved fault tolerance characteristics. The fault tolerance can be further enhanced by the capability possessed by such a meter of verifying its own functions. Nevertheless, fault tolerance remains a potentially vexing problem because the very components that are used to check for failure are themselves subject to failure.

In spite of the numerous potential advantages of electronic postage meters over their mechanical predecessors, and further in spite of the expanded capability of microcomputerized postage meters, efforts to design an electronic postage meter having sufficiently high levels of security and fault tolerance to obtain postal service approval have been generally unsuccessful to date.

SUMMARY OF THE INVENTION

The present invention is a microcomputerized postage meter that provides sufficiently high degrees of security and fault tolerance to make the meter suitable for postal service approval.

Broadly, the postage meter of the present invention includes a microcomputer system, a keyboard or other suitable input means for entering data and instructions into the microcomputer, a display unit for allowing the operator to determine the status of particular registers, and a postage printing mechanism. The printing mechanism and the electronic components are located within a secure housing, and unauthorized access is impossible without physical destruction of parts of the housing. The housing mounts on a conventional meter base which performs the various paper handling functions and contains the power supplies.

The meter maintains data security under low power conditions by the use of functionally nonvolatile memory units. Register and other data which must survive normal and abnormal losses of power to the meter electronics are stored in dual redundant battery augmented memories (hereinafter designated BAMs). The BAMs are also used to store historical information for maintenance purposes (e.g., total usage of print mechanism), information relating to particular features or options (e.g., fractional cents), batch information (number of pieces and dollar amounts), and failure information (discussed more fully below). The BAMs are mutually independent, and each BAM includes a low power CMOS memory and a long life (5 years or more) battery. While each BAM can be read independently of the microcomputer, writing of new data into each BAM can only occur under microcomputer program control.

The meter maintains the integrity of its functioning under low power conditions by generating and responding to two timed signals when a low power condition is sensed. A first signal, designated "SYSCLR" (system clear), has the effect of inhibiting all meter functions that could have an effect on the printing of postage or the register values in the BAMs. A second signal, designated "MPCLR" (microprocessor clear), inhibits execution by the microcomputer. The generation of these two signals in a particular time-ordered manner prevents spurious operation during power up and power down periods.

When the supply voltage supplied to the meter falls below a predetermined threshold deemed necessary to ensure continued reliable functioning of the electronic components, a portion of the circuitry initiates a graceful power down sequence. After a sufficient time to allow completion of any ongoing BAM register updates (about 20 milliseconds), a SYSCLR signal is generated, i.e., SYSCLR goes true, inhibiting writing to the BAMs, and disabling the print mechanism. Then, after a delay (about 1 millisecond), a MPCLR signal is generated, i.e., MPCLR goes true, and the microcomputer is disabled. A capacitor within the meter retains sufficient charge at a voltage above that required by the electronic components to ensure that the circuitry operates reliably during the power down sequence.

An analagous sequence occurs when power is first applied to the meter circuitry during a power up cycle. When the supply voltage to the meter electronics is non-zero but still below the predetermined threshold level, MPCLR and SYSCLR go true. After a sufficient interval after the time that the voltage has risen to the predetermined threshold value to ensure reliable microcomputer operation (about 50 milliseconds for the particular microcomputer used), MPCLR goes false, which allows the microcomputer to start executing an initialization routine. Then after a delay (about 2 milliseconds) SYSCLR goes false to permit normal meter functioning.

The basic operating philosophy of the postage meter is to maintain security under normal operating conditions by having the microcomputer supervise and verify the various meter functions.

Printing is strictly supervised by the microcomputer. The meter employs a print mechanism comprising a print head which includes a plurality of print wheels, and a plurality of stepper motors corresponding to the plurality of print wheels, each motor controlling the positioning (indexing) of an associated one of the plurality of print wheels. Each stepper motor has verification means for generating a digital code, preferably binary coded decimal (BCD) code, corresponding to the print wheel position. Locking means, such as a solenoid, under exclusive control of the microcomputer maintains the print head locked up in the home position except when printing is to be carried out in accordance with instructions from the microcomputer. Before freeing the print head for printing, the microcomputer verifies that the print wheels are in the positions corresponding to the desired amount of postage to be printed.

Changes to the register values in the BAMs can only occur under control of the microcomputer. In regular use, the meter is in a condition designated "mail room" mode wherein the only instructions available to the operator for changing the register values stored in the BAMS are the instructions for initiating a postage printing cycle. The effect of the print cycle is to decrement the descending register and increment the ascending register by the amount of postage printed. Register updating occurs only upon the receipt of a signal from the base that a clutch in the motor that drives the print head had been pulled or an internal signal that the print head has left its home position. As discussed above, the print head is freed only after the print wheel positions have been verified. Only authorized personnel can cause the microcomputer to execute a series of instructions to increase the control total value and descending register value by an amount corresponding to an amount of postage that is being added to the meter. Such instructions can only be executed when a mode-changing switch is actuated to switch the meter to a condition designated "post office" mode. In order to actuate the mode-changing switch, a seal must be broken and the switch unlocked with a special key available only to authorized personnel. The meter is not mounted on a base in the "post office" mode since no printing is to occur but rather, the meter is provided with external power to operate the electronic control circuitry.

All updating of register values, whether at the initiation of the print cycle or at the time of purchase of additional postage, occurs according to a checked arithmetic algorithm. The basic arithmetic constraint is that the ascending and descending registers sum to the control total. The mechanics of the checking and the updating differ somewhat, depending on whether the meter is in the "mail room" or "post office" mode. In both cases, an extra "temporary" copy of the ascending and descending register values and control total is stored in the BAMs, in addition to the redundant "permanent" values. A consistency check is made to ensure that the register values in one BAM agree with the corresponding values in the other BAM. In the "mail room" mode the temporary values are updated as each character is entered on the keyboard; in the "post office" mode updating of the temporary registers occurs only after the entire keyboard entry is complete. At each update of the temporary register values, the values are checked for adherence to the arithmetic constraint. Updating of the permanent registers occurs during the print cycle in the "mail room" mode and in response to a particular keyboard sequence in the "post office" mode. The updated permanent registers are then checked for agreement between BAMs and for adherence to the arithmetic constraint.

It is apparent that the use of redundant BAMs, the maintenance of temporary register values in the BAMs, and the manner of updating the BAM registers prevent the loss of correct register values in the event of many types of malfunction. For example, if the microcomputer where to cease execution while updating the permanent registers in the BAMs in either the "post office" or "mail room" mode, the temporary registers would still provide sufficient redundant information to permit retrieval of the correct register values.

However, once a malfunction has occurred, the meter no longer possesses the redundancy necessary to maintain security in the event of a further malfunction. Accordingly, there is provided a mechanism for disabling the meter once a first malfunction is detected. This results in a meter that possesses a level of fault tolerance wherein security is maintained in spite of a single malfunction. The meter is still susceptible to loss of the correct register values if two independent malfunctions occur in a particular complementary way (e.g., loss of power to one BAM and memory failure of the other BAM; simultaneous loss of power to both BAMs; compensating arithmetic errors in both of the BAMs). Such combinations of malfunctions are extremely rare since the individual malfunctions are basically independent occurrences that are themselves rare.

The meter disabling mechanism includes dual redundant flip-flops which are set to a "faulted" state upon detection by the microcomputer of a failure condition. These flip-flops are powered by the BAM batteries. The setting of these fault flip-flops lights an indicator lamp and generates a SYSCLR signal to inhibit all meter functions that could have an effect on the register values in the BAMs. In addition, the setting of the fault flip-flops generates an MPCLR signal to cause the microcomputer to cease execution. Setting of the fault flip-flops is inhibited by the presence of a SYSCLR signal, so that the fault flip-flops cannot be set during power up and power down cycling. The fault flip-flops, once set, hold SYSCLR and MPCLR true whenever power is supplied to the meter. They cannot be reset except by physical access to the meter interior, which access is only available to authorized personnel at the factory.

The fault flip-flops are also set when the microcomputer fails to properly execute its own operating program. Under proper conditions, the microcomputer periodically generates a signal which triggers two independent monostable multivibrator circuits, preferably retriggerable one-shots, to maintain a particular logic level on the one-shot output. The microcomputer responds to the detection of a fault condition by not triggering the one-shots. When there appears on the one-shot output a logic level that corresponds to the failure of the microcomputer to generate this signal, the fault flip-flops are set. In addition to programmed failures to trigger the one-shots, any circumstance (such as microcomputer failure) that prevents the microcomputer from triggering the one-shots has the effect of causing the meter to fault. Thus, the mechanism for setting the fault flip-flops exploits the microcomputer's ability to diagnose failures but may also be activated should the microcomputer itself fail.

Adherence of the register values to the arithmetic constraint, and consistency between the BAMs, as described above, are considered absolute prerequisites to continued meter operation. Thus if an arithmetic check yields inconsistent results, or if corresponding registers in the two BAMs disagree, the meter faults after writing an appropriate failure code to the BAMs. All writing to the BAMs is verified, and an error causes the meter to fault, preceded by the writing of an appropriate failure code.

During the printing operation, the microcomputer and associated logic elements test for various indications of malfunction of the print value setting and printing mechanisms. In particular, if during a printing operation the print head leaves its home position before the print wheels are positioned or the print head fails to leave its home position within a predetermined maximum time period (100 milliseconds) of the receipt of a clutch signal, the meter faults. In such cases, a numeric code representative of the particular problem detected is written to the BAMs prior to deactivation of the meter.

Other types of malfunction do not pose an immediate threat to security, and tend to be self-curing or one-time occurrences. These situations are handled by turning off the displays and stepper motors, locking the print solenoid, and causing the microcomputer to execute a trivial wait loop while still continuing to fire the one-shots. This condition is designated a "soft fault". The typical cause of a soft fault is some sort of mistake which necessitates suspending operation to prevent a second mistake which could cause an error. The mistake may arise from operator error, base malfunction, dirt, or noise. An example of soft fault is the apparent failure of a print wheel to move from one position to an adjacent position within a predetermined maximum time period (12.8 milliseconds). In many instances, the cause might be due to imperfect operation of the verification means, such as poor electrical contact due to dirt. In such a case, reinitializing the meter which causes the motors to be stepped through their entire range would cure this problem. Another example of a soft fault is the detection of a clutch signal when it is not expected. This could be caused by a malfunction in the base or it could result from improper paper handling by the operator. Again, reinitializing the meter would cause this problem to go away. A further example of a soft fault is the inability to verify a BAM address. Since the BAM address lines communicate outside the meter housing, they are susceptible to electrical noise which could cause a bad address verification. Again, this problem is likely to be intermittent in nature and does not pose a threat to security so long as no attempt is made to write to the BAMs.

Yet a further potential threat to the meter's security is present if the mode-changing switch malfunctions, giving a spurious indication to the microcomputer that the meter is in the "post office" mode since this could allow an unauthorized (unpaid for) increase of the control total and descending registers. To prevent such an occurrence, the microcomputer checks the mode-changing switch during initialization and at the beginning of a print cycle. If the meter is found to be in the "post office" mode while apparently mounted on a base at either of these times, a soft fault condition is considered to have occurred. One possible cause of such a condition is if a postal service employee actuates the mode changing switch while the meter is mounted on a base. So long as operation is suspended, no threat to security exists, and the soft fault condition is cured by having the postal service employee reinitialize the meter under external power (meter off base) or on the base but in the "mail room" mode.

During initialization, the microcomputer checks to make sure that no nonzero failure codes have been written to the BAMs. Once an error code has been written to the BAMs and the meter has faulted, it should be impossible to initialize the meter since the fault flip-flops hold MPCLR true when power is supplied. Thus, detection of a nonzero failure code is a possible indication of a BAM failure or an inability to read a good zero from the BAMs, and causes the meter to fault. Due to the nature of the error, no attempt is made to write a failure code.

Once the meter has been set to a "faulted" state, the BAM contents may still be read out independently of the microcomputer. During this time, the microcomputer is prevented from accessing the BAMs. This is accomplished by allowing power necessary to read the BAMs to be supplied to the BAMs without supplying power to the microcomputer. Moreover, even if the microcomputer is powered, MPCLR prevents it from executing instructions and SYSCLR isolates it. The various register values and the fault code then allow a reconstruction of the proper register values.

For a further understanding of the nature and advantages of the invention, reference should be had to the ensuing detailed description taken in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a perspective view of the exterior of a microcomputerized postage meter according to the present invention;

FIG. 2 is a perspective view of part of the print mechanism located within the housing of the meter;

FIG. 3 is a schematic block diagram of the electronic meter system;

FIG. 4 is a system flow chart illustrating the general operation of the invention;

FIG. 5 is a circuit diagram of the external power levels that are communicated from the base to the meter;

FIG. 6 is a circuit diagram of signals communicated from the base to the meter;

FIG. 7 is a circuit schematic of circuitry for generating certain internal signals within the meter;

FIG. 8 is a circuit schematic of the power surveillance and system reset circuitry of the present invention;

FIG. 9 is a circuit schematic of the circuitry that inhibits meter functioning upon detection of a fault condition;

FIG. 10 is a timing diagram illustrating the voltage levels responded to by the power surveillance circuitry of FIG. 8, and the signals generated by the system reset circuit of FIG. 8;

FIGS. 11a, 11b, and 11c, taken together form a circuit schematic illustrating the microcomputer and BAM control circuitry;

FIG. 12a and 12b, taken together, form a circuit schematic illustrating the microcomputer circuitry for refreshing the displays and reading the switches;

FIG. 13 is a circuit schematic illustrating circuitry for controlling the print wheel motors and reading the verification contacts;

FIG. 14 is a schematic illustrating a suitable memory allocation of registers required by the operating program of the microcomputer;

FIG. 15 is a schematic illustrating a suitable bit allocation for the switch registers;

FIG. 16 is a schematic illustrating a suitable bit allocation for the status and print routine registers;

FIG. 17 is a flow chart of the foreground routine;

FIG. 18 is a schematic illustrating the organization of the BAMs and the memory allocation of register values stored therein;

FIG. 19 illustrates in tabular form the temporary register contents after various operations;

FIGS. 20a, 20b, and 20c, taken together, form a flow chart of the print task routine;

FIGS. 21a and 21b, taken together, form a flow chart of the keyboard task routine.

DESCRIPTION OF THE PREFERRED EMBODIMENT

Turning now to the drawings, FIG. 1 is a perspective view of the exterior of a postage meter 5 according to the present invention. Meter 5 includes an exterior housing 10 for containing a print mechanism and electronic control system described in detail below. In operation, meter 5 is installed on a mailing machine base, not shown, which contains power supplies for the meter, performs paper handling functions (envelopes or tapes), communicates synchronizing signals to the electronic control system, and provides mechanical power for activating (but not setting) the print mechanism. Since the mailing machine base comprises a conventional ancillary device, a detailed description of the elements thereof is omitted to avoid prolixity.

The exterior components of meter 5 generally include a control panel and a door behind which is a postal service employee's panel. The control panel includes a keyboard 12, displays 15 and 17, indicator lights 20 and 22, and selector switches 25 and 27. The postal service employee's panel includes a remote power connector 28 for powering the meter when it is removed from a base, and a keylock operated mode changing switch 30 which, when actuated, places the meter in a "post office" mode to permit the postal service employee to change the register values to reflect a purchase of additional postage. Access to connector 28 and switch 30 requires the breaking of a seal 31 and subsequent sliding of door 11.

The plurality of keyboard keys, switches 25, 27, and 30, and displays 15 and 17 allow the operator or postal service employee to communicate with the internal electronic control system and to specify the necessary control signals for operation of the electronic control system and the print mechanism. Meter 5 may also operate under control of external devices (e.g. an electronic weighing station) and thus includes suitable connections for communicating electrical signals to the electronic control system within housing 10. Hereinafter, the term "switches", when used generally, will be taken to include the above switches and keys, the base synchronization signals, and signals from external devices.

Keyboard 12 comprises a calculator configured digit field including ten numbered keys 38, and special function keys 40 and 42, designated clear KB and clear batch, respectively. Data entry is effected by manually actuating numbered keys 38 in a sequence corresponding to the desired entry. The most significant digit is entered first, normally with a maximum dollar entry capacity of four digits (99.99 or 9.999 if a fractional cents meter). Attempts to continue entry beyond the four digit maximum are ignored. This entry capacity expands to up to eight digits when the meter is in the "post office" mode, the maximum number of digits being a preset parameter.

Display 15 is preferably a four-digit numeric display having characters sufficiently large to be readily visible in normal operation. A character height of about 0.6 inches is suitable. As data is entered via keys 38, it is displayed on display 15. As values are keyed in, they enter the right-most digit and are shifted left for each valid subsequent keyboard entry. Depression of clear KB key 40 clears the keyboard entry and display 15. Simultaneous depression of clear batch key 42 and clear KB key 40 initializes internal batch count and batch dollars registers. Display 17 is preferably a nine-digit numeric display and is used for displaying register values. Since this display is generally used less often than display 15, a smaller character size (e.g., approximately 0.125 inches) than that used for display 15 is suitable. Five position slide switch 25 allows the user to select an internal register to be displayed on display 17. In particular, descending register value, ascending register value, control total value, batch dollar amount, and batch count may be displayed. Two-position selector switch 27 has effect only if meter 5 has been pre-programmed as a "fractional cents" meter. In effect, switch 27 allows the operator to overide the fractional cents aspect during keyboard entry so that the last digit entered corresponds to cents rather than tenths of a cent.

When lit, indicator lights 20 and 22 serve to warn that operator that a condition has occurred which makes it necessary to at least temporarily suspend operation of the meter. Indicator light 20, designated "Service", is lit when the meter has been internally set to a faulted state. When light 20 is lit, the meter is inoperative, and must be returned to the factory before it can be used again. In addition, no set of keyboard entries or sequence of powering the meter can restore operation, and access to the housing interior, possible only at the factory, is required to place the meter in operative condition. Indicator light 22, designated "Add $", is lit when the amount of postage entered would cause the descending register value to become negative upon printing. Depressing "clear entry" key 40 extinguishes light 22 and allows subsequent meter operation at postage values which will not cause the descending register value to become negative.

The amount of postage available for printing may be changed by a postal service employee by placing meter 5 in the "post office mode". This is possible only when the postal service employee breaks seal 31 on switch 30, and enables movement of switch 30 to the "post office mode" position by actuation of keylock 32. When this occurs, keys 40 and 42 and switch 25 take on different functions. When switch 25 is moved to either of the batch register display positions, nine-digit display 17 functions as a keyboard verification display. Keyboard keys 38 retain their normal function of data entry, but special keys 40 and 42 allow the postal employee to change the values of the accounting registers. In particular, depression and release of clear batch key 42 causes the keyboard entry to be added to the descending register and the control total values. If clear KB key 40 is depressed while clear batch key 42 is also depressed, the keyboard entry is subtracted from the descending register and control total values when "clear batch" key 42 is released.

FIG. 2 is a perspective view of portions of the print mechanism located within housing 10 of meter 5. The print mechanism comprises a print head having a plurality of print wheels, a plurality of stepping motors (hereinafter sometimes referred to as steppers) to independently set the print wheels, and means for moving the entire print head to a printing position without disturbing the print wheel settings. FIG. 2 shows the print wheel setting means for a single digit. A print wheel 43 having a plurality of value indicating print surfaces 44 is driven by a stepping motor 45. Additional motors 46, 47, and 48, while not shown in FIG. 2, are shown schematically in FIGS. 3 and 13. Stepping motor 45 drives a gear 49 which engages a rack 50. Rack 50 is rigidly connected to a drive yoke 52 which carries a rotatably mounted drive ring 55. Drive ring 55 is slidably mounted on a rotatable bar 57 which has a channel 60 along its length. A rod 62 is disposed within channel 60, being coupled to drive ring 55 at one end and terminating in a rack portion 65 at the other end. Print wheel 43 has a gear 68, and rack 65 drives print wheel 43 through gear 68 and an idler gear 70.

Thus, rotation of gear 49 on the output shaft of motor 45 causes movement of rack 50 along the direction of bar 57. Movement of drive yoke 52 is transmitted through rod 62 and idler gear 70 to gear 68 and print wheel 43. Motor 45 is coupled to a position sensor 75, which in the preferred embodiment comprises verification contacts for generating a binary code representative of the position of an internal wiper connected to the motor shaft. Additional position sensors 76, 77 and 78 are associated with motors 46, 47, and 48, respectively, and while not shown in FIG. 2, are shown schematically in FIGS. 3 and 13.

It should be understood that a separate subassembly comprising a stepping motor, a motor gear rack, a position sensor, a drive yoke, a drive ring, a rod, a print wheel rack, an idler gear, and a print wheel substantially similar to elements 45, 50, 75, 52, 55, 62, 65, 70, and 43 is provided for each digit that can be printed. Thus, in the preferred embodiment where four digits may be printed, there are four such subassemblies. However, there is only one channeled bar 57, channel 60 being sized to accomodate four rods (including rod 62) in a side by side configuration.

Printing occurs by a rotation of bar 57, the mechanical power being supplied by the base. It should be noted that the drive yokes, while movable along bar 57, are prevented from rotating. Rather, bar 57 rotates independently. The print head (which includes the print wheels) is maintained in a fixed relationship with respect to bar 57 so that rotation of bar 57 brings the print head from a normally upwardly facing disposition into a downwardly facing position for printing, during which the print wheels are exposed at an opening in the bottom of housing 10. A solenoid 85, shown schematically in FIG. 12 prevents movement of the print head in the absence of a specific print enabling signal.

FIG. 3 is an electrical schematic showing in functional block diagram form the electronic circuitry located within meter 5. Whenever meaningful, reference numerals corresponding to those associated with the physical representation of the same components in FIGS. 1 and 2 are used.

The central element in the meter electronic circuitry is a microcomputer 90 having contained program memory, working memory, and processing capabilities. During operation, microcomputer 90 is responsible for performing several functions, including periodic refreshing of the displays, periodic sampling of all the switches, communication with external devices, detection of synchronizing signals from the base that signify the initiation of a print cycle, initiating and verifying print wheel setting, and performing accounting functions. Since microcomputer 90 is required to communicate with a relatively large number of peripheral devices, it operates in conjunction with input/output (hereinafter designated I/O) expansion circuitry. The I/O expansion circuitry includes I/O expanders 92 and 93, demultiplexers 94 and 95, and multiplexers 96 and 97. As will be described in detail below, I/O expander 92 provides signal paths, via demultiplexers 94 and 95 and multiplexer 96, between microcomputer 90 and the displays and switches. The switch status is communicated to microcomputer 90 on an output line 98 of multiplexer 96. In a like fashion, I/O expander 93 allows microcomputer 90 to send signals for driving the stepping motors, while multiplexer 97 allows microcomputer 90 to receive information on a line 99 from the motor position sensors.

In addition to the switches, displays, motors, position sensors and I/O expansion circuitry described above, the circuitry includes dual redundant battery augmented memories 100 and 102 (BAMs). The BAMs are used to store information which must survive normal and abnormal losses of electrical power to the meter. This includes register data (ascending register value, descending register value, control total value), batch count information, and failure information, all to be discussed in greater detail below.

The circuitry also includes power surveillance circuitry 105 for detecting what is anticipated to be a low power situation, and system reset circuitry 110 that responds to low power conditions by generating timed signals, designated "SYSCLR" (system clear) and "MPCLR" (microprocessor clear), in a particular time ordered manner for a graceful power up or power down sequence. Dual redundant fault flip-flops 111 and 112 are coupled to the system reset circuitry to inhibit meter functioning once the flip-flops are set to a "faulted" condition. Flip-flops 111 and 112 are maintained in a non-faulted state by the outputs of dual redundant retriggerable one-shots 113 and 114, respectively. During operation, so long as no failure condition is detected, microcomputer 90 periodically sends a signal to one-shots 113 and 114 to prevent flip-flops 111 and 112 from being set. Setting of flip-flops 111 and 113 occurs whenever the microcomputer fails to send a signal to one-shots 113 and 114 within a predetermined time period. This occurs either when the microcomputer detects any one of a number of failure indicating conditions, or when the microcomputer itself fails to properly execute its operating program.

Microcomputer 90 communicates with the remaining circuitry primarily via three eight-bit data buses 120, 125, and 130, designated DB, P1, and P2 respectively. Individual lines on buses 120, 125, and 130 are designated DB0-DB7, P10-P17, and P20-P27, respectively. Buses 120 and 125 communicate with external peripheral I/O devices, designated generally by reference numeral 131. I/O devices 131 communicate signals which cause microcomputer 90 to carry out the same tasks as it would in response to corresponding switch manipulations. Within meter 5, certain of these data lines serve dual functions. In particular, bus 125 communicates with BAMS 100 and 102 for supplying an address, and with displays 15 and 17 through a buffer 128 on an eight-bit line 129 for supplying a digit code. Also, lines 132 and 133 of bus 130 serve the dual function of selecting which of BAMS 100 or 102 is to be accessed and of selecting which of I/O expanders 92 and 93 is to be accessed via four-bit line 134 of bus 130. Additionally, a four-bit line 135 from I/O expander 92 communicates with the BAMs for supplying data and further communicates with multiplexer 97 for selecting a particular bit from one of motor position indicators 75-78.

Having discussed the general structure of the meter electronic circuitry, the general operation of meter 5 under the control of microcomputer 90 may be described. Broadly, microcomputer 90 executes instructions according to an operating system which includes an initialization routine, a foreground routine, a power loss interrupt routine, background dispatcher loop, and a plurality of background tasks, including subroutines. The background dispatcher loop is, in effect, the main program, and will sometimes be referred to as such. FIG. 4 is a flow chart illustrating the relationship between the initialization routine, the background dispatcher loop, and the background tasks.

Given the conflicts on buses 120 and 130 it is necessary that data or addresses on these lines that could affect access to the BAMs not be disturbed by an attempt to use one of the lines for its alternate function. Thus, the operating system of microcomputer 90 maintains a sharp division between those portions of the program that access the BAMs (designated background) and those portions of the program according to which microcomputer 90 communicates with the switches, displays, and the like (designated foreground).

The background dispatcher loop and the various background tasks are responsible for the normal meter functions including print supervision and accounting, and rely on information supplied by the foreground routine. The foreground routine is executed in response to a periodic timer interrupt generated by a timer inside microcomputer 90 and has the basic functions of energizing the displays, reading the switches and base synchronization signals, and sending signals to one-shots 113 and 114 to prevent fault flip-flops 111 and 112 from faulting the meter. The state of the various switches ascertained by the foreground routine is stored in switch registers within the working memory of microcomputer 90, so as to provide information to other parts of the operating system. The basic constraints on the timer interval are imposed by the requirements that the display digits be energized a particular number of times per second and that the keyboard switches be read more often than the minimum duration of a switch closure. As will be seen below, the rate at which the one-shots must be triggered is an easily varied parameter.

Upon receipt of a signal from power surveillance circuitry 105, an interrupt is generated, and the power loss interrupt routine is entered. This routine blanks displays 15 and 17, deenergizes stepping motors 45, 46, 47, and 48, and sets solenoid 85 to the print disabling position. The routine also sets a bit in memory, in analogy to the switch registers to communicate to the background that a power loss interrupt has occurred.

Turning to the background, with reference to FIG. 4, after execution of the initialization routine (block 150), microcomputer 90 sets a bit in its memory to signify that no BAM accesses are in progress, this state being designated "enable foreground" (block 152), and enters the background dispatcher loop indicated generally within dashed rectangle 154. Within this loop, microcomputer 90 sequentially checks the status of the power loss bit and various so-called WAKEUP bits that will have been set by the foreground routine, and jumps to an appropriate background task as required. The first check is whether the power loss bit has been set (block 158). If it has, microcomputer 90 executes a wait loop 160 until the system reset circuitry generates an MPCLR signal to cause microcomputer 90 to cease execution. Assuming no power loss, microcomputer 90 sequentially checks the WAKEUP bits to determine whether a register display is required (logical branch 162), whether the meter is in a print cycle (logical branch 164), whether an I/O request has been made (logical branch 166), whether the keyboard register has changed indicating a new keyboard entry (logical branch 168), and whether a print task is to be performed (logical branch 170), before returning to the beginning of the background dispatcher loop. During a print cycle, I/O requests and new keyboard entries are ignored, as indicated by branch 171.

Assuming that a register is to be displayed, that an I/O request is present, that a new keyboard entry has been made, or that a print task is to be performed, the program jumps to the appropriate background task indicated by blocks 172, 176, 178, and 180 respectively. The particular features of the background task routines will be described in detail below. Since execution of each of these background tasks involves access to the BAMs at some point, the foreground is immediately disabled so that data on the lines to the BAMs will not be overwritten during the execution of the foreground routine which occurs in response to a timer signal not under the control of the background dispatcher loop. After completion of the appropriate tasks, each of the background routines returns to the background wait loop after enabling the foreground (block 152). Under certain circumstances, the print task routine does not return directly to the main background loop, but first jumps to a portion of the keyboard task return before returning (blocks 182 and 183).

A detailed description of the foreground routine is deferred until after the structure of the meter electronic circuitry has been set forth in greater detail. Nevertheless, the following general description is set forth in order to make clear the overall operation of the meter operating system. The foreground routine does not accomplish all its tasks on a single entry. Rather, a total of 27 timer interrupts are required for a complete cycle. Thus a 400 microsecond timer interval results in a cycle time of about 11 milliseconds, which correlates with the need for the digits of display 17 to be energized approximately 80 times per second. Also, the 11 millisecond interval is considerably shorter than the 50 millisecond minimum duration of a pulse resulting from the depression of a keyboard key.

The digits on display 15, requiring greater brightness than those on display 17 must be energized more often. In particular, display 15 is energized four times for every time that on display 17 is energized. As will be discussed in greater detail with reference to FIGS. 12a and 12b, sending a signal to energize a particular digit on display 15 or 17 allows a particular position of register display selector switch 25 or a particular keyboard switch 38 to be read. The state of the remaining switches must be separately determined. Since switch noise having a duration of approximately 2 milliseconds is inevitably present during the initial actuation of a switch, the foreground routine debounces the switches and does not consider a switch state to have changed unless it remains changed on two successive readings (i.e., for more than 11 milliseconds).

Upon entering the foreground routine in response to an interrupt from the 400 microsecond timer, microcomputer 90 checks the foreground bit to determine whether the foreground is enabled or whether a background task was in progress. If the foreground is enabled, the routine does the appropriate display energization and/or switch state read according to a sequence to be described below. Assuming the foreground is enabled, the routine then checks whether the interrupt is a particular one in the sequence that requires a signal to be sent to the fault one-shots and only triggers the one-shots at that particular point in the sequence. If the foreground was not enabled, the routine triggers the fault one-shots regardless of the interrupt's position in the sequence control and then passes to the background routine.

The discussion immediately following is with reference to FIGS. 5-13 which are circuit schematics illustrating in greater detail the electronic meter system set forth in the block diagram of FIG. 3. Accordingly, in the discussion that follows, reference should, at appropriate times, also be made to FIG. 3. The circuit elements are, wherever practical, solid state integrated circuit components. Suitable components are set forth in the following table:

    ______________________________________
    Function    Type         Manufacturer
    ______________________________________
    Microcomputer
                8049         Intel
    BAM         P5101L-1     Intel
    I/O Expander
                P8243        Intel
    Comparator  LM2903P      National Semiconductor
    Buffer      ULN2003AN    Texas Instruments
    One-shot    MC14538BP    Motorola
    Nand gate   MC14011P     Motorola
    Nor gate    MC14001      Motorola
    OR gate     MC14071      Motorola
    Multiplexer 74C150       National Semiconductor
    Demultiplexer
                74145        Texas Instruments
    ______________________________________