Postal meter using microcomputer scanning of encoding switches for simultaneous setting of electronic accounting & mechanical printing systems4481604Abstract An entire electronic accounting and controlling system for a franking machine is mounted on two connected printed circuit boards, one along the top of the machine and the other along one side of the machine within the machine casing. The top board carries four rotary encoding switches and press button switches which are scanned by signals from a microcomputer on the side board passing to a binary counter controlling a binary to decimal decoder to send multiplexed signals to the switches enabling the rotary switches to send four pairs of five-bit words along ten scanning lines to the microcomputer which delivers equivalent eight-bit error immune signals to duplicate non-volatile memories. The press button switches send signals along the scanning lines to enable a display module on the top board to display decimal digits according to the information stored in the memories. A printing drum is set mechanically simultaneously with the rotary switches. When a sealed door in the casing is opened a switch is automatically actuated to change over from customer mode to Post Office mode. Claims We claim: Description FIELD OF THE INVENTION
TABLE 1
__________________________________________________________________________
COMMON 44 COMMON 43 COMBINATION
DECIMAL
E D C B A E D C B A E D C B A
__________________________________________________________________________
0 0 0 0 0 1 0 0 0 1 0 0 0 0 1 1
1 0 0 0 0 1 0 0 1 0 0 0 0 1 0 1
2 0 0 0 1 0 0 0 1 0 0 0 0 1 1 0
3 0 0 0 1 0 0 1 0 0 0 0 1 0 1 0
4 0 0 1 0 0 0 1 0 0 0 0 1 1 0 0
5 0 0 1 0 0 1 0 0 0 0 1 0 1 0 0
6 0 1 0 0 0 1 0 0 0 0 1 1 0 0 0
7 0 1 0 0 0 0 0 0 0 1 0 1 0 0 1
8 1 0 0 0 0 0 0 0 0 1 1 0 0 0 1
9 1 0 0 0 0 0 0 0 1 0 1 0 0 1 0
__________________________________________________________________________
Accordingly it is necessary for the outputs to pass to a device, such as a microprocessor, capable of recognising the coded information from the switch, determining for security reasons, that there is a single "1" in each word received, and then combining the pairs of words to obtain the required 2 out of 5 code which in turn is recognised as a decimal number. The four encoding switches 14 are shown in an expanded diagrammatic form in the circuit diagram of FIG. 11 as eight separate 1 out of 5 encoding switches 14A operated in pairs. The encoding switches represented by 14A form part of an input module 52 with which are associated the aforementioned switches 24, 25, 27 fed through buffers 7/2, 7/3, 7/4 (e.g., Ser. No. 7,407), and push button switches 29, 30, 31, 32, 34, fed through buffers 6/2, 6/3, 6/5, 7/5 and 6/6 (e.g., Ser. No. 7,407). All these buffers as well as the inputs to the encoding switches are connected respectively by ten lines 53 to a binary to decimal decoder Q11 (e.g., Ser. No. 7,4145). A microcomputer Q5 (e.g., 8049) which is provided with a ROM and into which is masked various software instructions, provides the primary control of the operation of the meter. It has a limited number of input lines P24-P27 and To that can read signals from the switches and press buttons associated with the input module 52. The total number of signal outputs from the encoding switches alone exceeds the number of input lines. Therefore, a time division multiplexed (TDM) system is employed in which ten groups of five signals are sampled sequentially along five lines 54A-54E. The TDM scanning is provided by a binary counter Q8 (e.g., Ser. No. 7,493A) and the decoder Q11. The counter Q8 operating under control of signals from line P22 of the microcomputer provides cycles of four inputs through a binary-coded decimal sequence of 0000 to 1001 to the decoder Q11 which produces a logic level "0" on each of the ten output lines 53 in turn as its four inputs cycle through the BCD sequence. The sequence of cycles of four signals on the four outputs of QA, QB, QC, QD of counter Q8 follows that shown in Table 2 below. It is possible for a microcomputer Q5 to be selected or for the microcomputer Q5 to be adapted for the provision of feedback means comprising lines 53A, 53B described below to enable the microcomputer Q5 to monitor the sequence from scan 2 to scan 9 inclusive.
TABLE 2
______________________________________
COUNT QA QB QC QD
______________________________________
0 0 0 0 0
1 1 0 0 0
2 0 1 0 0
3 1 1 0 0
4 0 0 1 0
5 1 0 1 0
6 0 1 1 0
7 1 1 1 0
8 0 0 0 1
9 1 0 0 1
10 0 1 0 1
11 1 1 0 1
12 0 0 1 1
13 1 0 1 1
14 0 1 1 1
15 1 1 1 1
______________________________________
0 = 16? A quadruple D-type flip flop Q6 (e.g., MC 14175) is used as a
four bit latch to store logic signals. The microcomputer Q5 counts the
number of signals sent through output P22 and after nine transitions
initiates signals through line RD and output PO2 to latch Q6 which results
in logic `0` which appears on line Q4 of latch Q6 which is then
transferred onto an inverting buffer 9/6. The inputs of decoder Q11 change
to 0000 and the microcomputer Q5 initiates another pulse through RD and
logic `1` at 4D of latch Q6 to alter the output of inverting buffer 9/6 to
permit Q8 to count again.
Several complete scans are performed by the microcomputer Q5 during which the status of all the switches in the input module 52 remain constant before the microcomputer recognises the resulting signals as valid. This guards against transient electrical interference as well as switch bounce. The microcomputer Q5 interacts with the input module 52 to verify correct scanning sequences and to detect faults on lines; for example, the failure of a scan of one of the encoding switches to include two "1s` (Table 1) or, alternatively, two "0s" according to the arrangement of the logic levels. A buffer 7/6 shown at the lower right hand corner of FIG. 11 presents the microcomputer with a "0" through line 54E at the beginning of the first scan of a sequence. Failure to do this induces an eventual shutdown of the meter. Central to the correct functioning of the input module 52 is its interaction with the microcomputer Q5 to verify correct sequence of scanning and to differentiate between fatal and non-fatal faults. Any fault that is non-periodic and intermittent, but does not in any way influence the status of the input variables (i.e., status of the encoding switches 14, status switches 29, 30, 31, 34 and command switches 24, 25, 27, 32) and does not degrade the system performance appreciably, is defined as a non-fatal fault, such as noise spike or switch bounce. A fatal fault renders the meter inoperative. The detection of fatal faults associated with the input module 52 is achieved by taking feedback connections from outputs Q.sub.B and Q.sub.C of counter Q8 to respective microcomputer inputs PO7 and PO6. After initiating each scan, the microcomputer inputs these feedback states from outputs QB and QC according to Table 2. Coupled with the above fact, is the fact that the mechanical construction of the encoded switches 14 prevents the same output occurring on the same one of the lines 54 A-E in each of the consecutive scans 2-3, 4-5, 6-7 and 8-9 by way of outputs Q2 to Q9 of decoder Q11, so that the microcomputer is enabled to monitor scans from 2 to 9. Although the above statement is true under normal operation, there is still a possibility of mis-reading the encoding switches under certain failures. For example, if the QD output of counter Q8 failed in the "O" state, the normal scan of 10 by the microcomputer Q5 would be allowed to energise the outputs of Q11 in the following order: 0123456701 etc., as compared to the normal order of: 0123456789 etc. It can be clearly seen that this would create a wrong value for the most significant encoded switch, i.e., the encoded switch 14 (lowermost switches 14A in FIG. 11 connected to outputs Q8, Q9) allocated to the thousands order. The status of the groups of switches 29, 30, 31, 34 and 24, 25, 27, 32 would be read as the value for the most significant encoded switch. In order to overcome this possibility of mis-reading, the command and status switches are arranged as shown in FIG. 11. At scan 0 through Q0 in decoder Q11 the status switches 29, 30, 31, 34 and a deliberate open circuit at buffer 6/4, are sampled which ensures a logic "1" at line 54C. At scan 1 through Q1 in decoder Q11 the command switches 24, 25, 27, 32 and deliberate short circuit at buffer 7/6 are sampled to ensure a logic "0" at line 54E. (This particular short circuit is also used to initiate a trip cycle as described later). This arrangement is such that it produces a 5 bit code that is different to the 5 bit code produced by the encoding switches at all possible combinations of the command and the status switches. By creating this disparity, any misreading is averted and the microcomputer is able to monitor the scans from 0 to 9 successfully and make the meter inoperative in the event of fatal failures in the input module. It is to be noted that the simultaneous operation of switches 24 and 25, as described above with reference to FIG. 1, the inaccessability of switch 34 in the customer mode, and the fact that switch 34 can only be operated in the post office mode when the switch 27 is open (FIG. 9), combine to produce a reliable input status monitoring system. If the switch 34 was operated when the switch 27 was closed the microcomputer would detect this as a fatal fault. Description of some common faults and their detection is given below: If buffer 9/6 fails as to prevent counter, Q8 being reset after scan 9, no deleterious effects follow as the absence of logic "0" at line 54E at scan 1 and the reinitialisation of counter Q8 after scan 15 would be consequently detected and the meter made inoperative. If the outputs of either counter Q8 or decoder Q11 develop a permanent fault, (either stuck at "0" or stuck at "1") the combination of invalid feedback states from counter Q8 and the appearance of incompatible 5 bit code at lines 54 A-E, are interpreted by the microcomputer as fatal faults and once again the meter is made inoperative. The afore-mentioned failure detection is also extensively used in production and in field service to pin point components which cause such failures and reduce the mean time to repair. The primary objective of the time divisional multiplexed scanning system is to replenish peripheral registers in the microcomputer Q5 with current status of input peripheral elements; to provide a high enough sampling rate to differentiate between transitory states of input peripheral elements (e.g., switch-bounce) and stable states; and to provide a scan rate sufficient to produce a flicker-free display in a display module 55. It is often found in various applications of microcomputers that the input/output capability of the microcomputers is required to be increased. This increase in input/output capability is easily achieved by incorporating devices known as input/output expanders in the system. Although the embodiment of the franking meter according to the invention shown in the drawings called for more outputs than the microcomputer can provide, this need is successfully met by incorporating the inexpensive quadruple D-type flip-flop Q6 so that the need for the inclusion of an expander is averted. The outputs of latch Q6 are manipulated by creating the desired states at the respective inputs and by the generation of a pulse at RD output of the microcomputer. Since pulses are generated at RD output of the micro-computer during memory read or port O (see below) input operation, it is important that the microcomputer sets the inputs of latch Q6 at desired states before embarking upon such operations. This can be achieved by making lines 54 A-E in a logic "1" state if necessary and by either setting or re-setting the other inputs to latch Q6. The microcomputer Q5 and the latch Q6 form part of a processing module 56. The design objectives of the processing module 56 are (see particularly FIG. 10): 1. To process franking data, execute fault tolerant/safeguard and anti-noise algorithms when required and to do adequate system and self diagnosis; 2. To provide the scanning signals to, and verify the validity of the data from the input module 52; 3. To provide a trip signal via latch Q6 to the trip solenoid 20 to initiate a franking operation; 4. To provide scanning signals and illuminating signals for the display module 55; 5. To provide a signal via latch Q6 to actuate an over-voltage protection and shutdown module 66; 6. To provide signals to read from and write to or render quiescent ultra low power memories Q2 and Q4 in a memory module 57; 7. To sample inputs to verify the correct functioning of all modular parts of the machine. The memories Q2 (e.g., 6508) and Q4 (e.g., 6508) are written sequentially and can be read either simultaneously or in sequence. The address to the memories Q2, Q4 is written from Port 1 (outputs P10-P17) of the microcomputer and the data from Port 0 (P00-PO3). This greatly reduces the dependance on critical parameters such as the address hold time and the fall time of the ALE signal. Since several ALE negative transitions may occur before the actual read or write operation of the memory, the probability of incorrect addressing is reduced as well. The address lines are also deliberately made bi-directional as to give the microcomputer more capability of diagnosis as, for example, write then read and verify the address. The memory Q2 is written to through an inverting buffer 9/4 (e.g., LS 7405) and NAND gates 2/1,2/4 (e.g. MC 14093) and buffer 9/3. The memory Q4 is written to through an inverting buffer 9/2, NAND gates 1/1, 1/2 (e.g., MC 14093) and buffer 9/3. The memories Q2 and Q4 are read respectively through DO outputs by synchronising signals at NAND gates 2/1, 2/4, 1/1, 1/2 and buffer 9/3. The second inputs to the NAND gates 1/1, 1/2, 2/1, 2/4 are controlled for effecting the writing and reading operations from a microcomputer output P23 and Q2 output of latch Q6 by way of inverting buffer 9/5 and pairs of inverting gates 1/3, 1/4, and 2/2, 2/3. It will be seen, therefore that the select lines of both memories Q2 and Q4 are derived respectively from different integrated circuit packages namely the latch Q6 and microcomputer Q5, so as to eliminate any indefinite selection of the memories in the event of failure of either Q5 or Q6 and hence the probable destruction of the contents of both memories Q2 and Q4. In each memory the information is stored as an eight bit word in cells sequentially located. Address lines A0-A8 are common to the memories, and the bits may be stored in identical address locations in each memory. The accounting data consists of only four bits. The remainder are added as part of an error detecting and restoring code. Up to two bits in error can be detected and a single error can be corrected. The specific patterns of bits based on a well known coded system are shown in Table 3 below, whereby four check bits are added to each sequence of data bits so that each such sum will remain different from all the other sums even if its contains two errors.
TABLE 3
______________________________________
DATA CHECK
______________________________________
0 0 0 0
1 1 1 1
0 0 0 1
0 1 0 0
0 0 1 0
0 0 1 0
0 0 1 1
1 0 0 1
0 1 0 0
0 0 0 1
0 1 0 1
1 0 1 0
0 1 1 0
1 1 0 0
0 1 1 1
0 1 1 1
1 0 0 0
1 0 0 0
1 0 0 1
0 0 1 1
1 0 1 0
0 1 0 1
1 0 1 1
1 1 1 0
1 1 0 0
0 1 1 0
1 1 0 1
1 1 0 1
1 1 1 0
1 0 1 1
1 1 1 1
0 0 0 0
______________________________________
The microcomputer also utilises superfluous cells in both memories Q2 and Q4 as dummy locations as to perform read, write and verify operations in order to validate the integrity of both memories before embarking upon system read and write operations i.e., up-dating the memories after a trip cycle. This is also a powerful tool for diagnosing certain system failures such as a permanent fault at gates 2/1, 2/4, 1/1 and 1/2. A further safeguard is provided by a comparison of the data in each memory with that in the microcomputer Q5 during use. At power up a comparison is made between the memories. At power down the microcomputer memory is discarded. However, the data in the memories is made non-volatile in that each memory together with protection control gates has its own long life battery 58 to retain the information when mains power is removed. Decoupling capacitors C9 and C13 are provided and diodes D10 and D19 prevent reverse current flow through the batteries when the main supply is on. Resistors R19, R20, R25, R26 are pull up resistors to ensure a clearly defined logic "1" during power off states. Resistors R29, R31 are pull up resistors to provide logic compatibility between the microcomputer and memories. The address lines A0-A8 are driven by signals from the microcomputer at its outputs P10-P17. The logic condition of these lines is governed by the microcomputer programme. Data inputs Di for the two memories are taken respectively from microcomputer outputs PO1 and PO3. Data outputs DO are connected respectively to the microcomputer respectively at POO and PO2. Redundancy is adequately achieved by having all the interconnections from each memory independent of the rest of the system with the exception of the address lines A0-A8. The only probable failures are, therefore, safe failures. All other connections are made completely separate and the susceptible lines such as those connected to the inputs STR and WE are deliberately gated by different packages of gates as indicated above. The failure of an integrated circuit package does not lead to the destruction of both memories. The fact that the WE inputs of the two memories originate from the different outputs WR and PROG of the microcomputer instead of the more conventional single WR output means that data corruption in both memories is prevented in the event of a WR output failure. Thus, an unusual way of accessing the memory Q2 is provided. The microcomputer writes to memory Q2 by executing the instructions that would be needed as if it was communicating with an input/output expander. The PROG signal generated by this action is gated to produce a WE signal for memory Q2. This also gives the microcomputer more capability for failure analysis under various fault conditions. The inclusion of the aforementioned method requires another set of instructions in addition to the other set for memory Q4. These two sets are mapped onto two different spaces in the ROM of the microcomputer. This gives additional safeguard against failures such as the failure of the program counter of the microcomputer. By careful choice of memory space and by adequate separation of software modules, an incorrect access to both memories due to microcomputer failure is successfully averted. The software also takes into account, the failure of increment/decrement counter, registers failure, input/output ports failure and general system noise during power up and power down. The packaging is optimised to give the memories adequate protection from airborne radiation and static discharge. The packaging and power supply for the memories is described in greater detail below in relation to a power supply module 65. The display module 55 includes an alphanumeric display consisting of typically nine blocks 59 of seven segments plus a decimal point. Each segment within a block is a variant of the traditional triode valve. A filament heated cathode provides an electron supply. The electrons are allowed to bombard an anode under control of a biassed grid. The anode comprises a shaped chemical material which fluoresces when the anode is bombarded. The nine blocks of segments are scanned sequentially at a high enough rate to prevent flicker by the action of the counter Q8, the four ouputs QA-QD of which are fed to a low power inverting binary to decimal converter Q10 (e.g., MC 14028). The outputs of the converter Q10 are fed to non-inverting buffers Q7, Q9 (e.g., each UDN-6118). The buffer Q9 enables a 24 volt input to provide sufficient current for the filaments to form a character from the seven anodes in each block 59, synchronously with scanning of the nine blocks of segments. The microcomputer Q5 provides signals through a group of outputs P10-P16 and the buffer Q7 that determine which grids in each block are to cause their anodes to be illuminated. The microcomputer is not capable of driving the buffer Q7 directly and does so by way of buffers 5/5, 5/6 and 4/6-4/2 (e.g., MC 14050). A decimal point, when required, is signalled from output P17 in the microcomputer through inverting buffer 4/1 and a high voltage (24 volt) buffer 6/1 to the blocks of segments. A power supply module 65 is designed to provide power for the electronic components and electro-mechanical elements, to provide protection for the electronic components against mains born interference, to provide individual power supplies for the memories and to create evidence should any attempts be made to alter the status of the equipment by indirect electrical means. In the power supply module 65, a mains transformer T1 has dual secondary windings respectively feeding bridge rectifiers B1, B2. One bridge output is filtered by a large value electrolytic capacitor C1. This reduces the ripple content of bridge B1 output to a semi-conductor regulator Q1 which maintains a +5 volt line 81 to enable the microcomputer to complete its functions immediately following a power down condition. The regulator Q1 is a three terminal device with a heat sink, which has its reference built in. The regulator is supplied through a quick blow fuse FS1 which has a rapid response due to a silicon controlled rectifier SCR1 in the over voltage module 66. Memory supplies VCC (M1) and VCC (M2) are derived through resistors R13, R14 and diodes D7, D9. D8 is a quick response, high energy zener diode with a very large transient power absorption capacity and is used for the protection of line 81 against breakdown of the regulator Q1 prior to the operation of the over voltage protection module 66 (which has a 200 .mu.s delay). Capacitor C7 acts as a filter as a protection element in conjunction with diode D8. The memory supplies are fed through diodes D12 and D13 to prevent the batteries 58 draining when power is off. To the first order, the forward voltage drops of D12, D7 and D13, D9 mutually cancel. The regulation and ripple conditions of the memory supplies are substantially those of line 81. The simple arrangement whereby the zener diode D8 provides filtering for high frequency positive excursions on the +5V supply line and whereby the supplies for memories Q2 and Q4 are derived respectively from diodes D13 and D12, not only provides adequate redundancy of the supplies to the memories, but also prevents SCR latch up effect at memory inputs by ensuring that the input signals do not exceed the memory supplies by more than 0.3 V. In the event of such a latch up as a result of either D12 or D13 failure, the memory integrated circuit can become very hot. For this very reason, as well as to provide dissimilar environments to the memories Q2 and Q4, they are packaged as far apart as the physical constraints allow. The control and data inputs and outputs of memories Q2 and Q4 are laid on a printed circuit board orthogonally to the respective address lines for the memories, and the respective supply lines are made as wide as necessary to reduce cross-talk, general system noise and to comply with proper printed circuit board layout practice. The anode cathode potential Vf+, Vf- for the display 59 is generated by a conventional resistor zener diode combination R18, D14 across the regulator output. The VCC output of the line 81 supplies logic units and the microcomputer Q5. The output from the bridge rectifier B2 provides, by way of resistor R54, zener diode D4 and capacitor C4, the 24 volt supplied for the display module 55. A diode D3 is connected from the output of bridge rectifier B1 to the junction of zener diode D4 and resistor R54 so that an abnormal increase in mains supply voltage will cause diode D3 to be destroyed thus providing evidence of the occurrence of this abnormal condition. The bridge rectifier B2 also supplies a trip module 82 for operating the trip solenoid 20 to initiate the printing operation as described above. A capacitor C5 is used to store the charge to operate the trip solenoid when a transistor T3 switches on. Capacitor C5 is charged via resistor R10 and a slow blow fuse FS2 which isolates the trip solenoid either under the control of the microcomputer due to defined system failures e.g., fault in input module 52, or if the transistor T3 becomes short circuited between collector and emitter. Transistors T3 and T4 are used to switch the charge stored in capacitor C5 to operate the solenoid 20. The signal for this is delivered by the microcomputer Q5 by way of the latch Q6 when the microcomputer has noted that the input of P27 from line 54E is "0" and has monitored the condition of the two microswitches 24, 25 thereby diagnosing the correct behaviour of the printing drum. The consequent output signal at Q1 on Q6 is "1". This signal is delivered through inverting buffers 5/4, 9/1. A resistor R24 provides current to drive transistor T4 into saturation via diode D16 when inverting buffer 9/1 goes to "1" as this buffer alone does not provide sufficient drive current. When trasistor T4 conducts its collector current, defined by resistor R23 and the base emitter T3, ensures that even with minimum design gain sufficient collector current flows through T3 to operate solenoid 20. The resistor R10 not only limits the charge current of capacitor C5 but also limits the current drawn from bridge B2 when transistor T3 switches on. The diode D16 increases the noise immunity of transistor T4 and resistor R55 provides a discharge path to ground. The +5 volt supply line 81 is connected by line 83 to a comparator unit Q3 (e.g., MC 3423) consisting of two comparators a constant current source and a 2.6 volt reference. The line 83 is divided by resistors R21 and R22 to provide the input for the first comparator. The input of the second comparator is connected to the current source output of the first comparator and a delay element consisting of a capacitor C12. Normally the first comparator is in the `on` condition, clamping the constant current source to ground. Consequently the second comparator, which connects the constant current source and reference voltage, is in the `off` condition. When the line 83 exceeds a specified voltage, the input to the first comparator exceeds 2.6 volts so that it unclamps the constant current source with the result that the capacitor C12, connected between the constant current source and ground, charges until it reaches 2.6 volts whereupon the second comparator switches SCR1 via R17. Therefore, upon firing the silicon controlled rectifier causes the line 84 to conduct and blow the fuse FS1. The constant current, the 2.6 volt threshold of the second comparator, and capacitor C12 produces a delay of 200 .mu.s before the second comparator changes state. Therefore, the output from the rectifier B1 is short circuited and regulator Q1 is cut off if the voltage of the line 81 exceeds a certain value for longer than a predetermined time. The first comparator in the unit Q3 is arranged to drain current through diode D17 and resistors R27 and R28 so that normally the voltage across a diode D18 and the base/emitter junction of a transistor T5 is not sufficient to turn T5 on. However, when the capacitor C12 charges the potential across D18 and T5 rises until it is sufficient to turn transistor T5 on. Thereby line 85 is rendered conductive and the NAND gates 2/1 and 1/1 ensuring the master control of the memories are shut down. Therefore, the memory data is protected before the power supply is interrupted by blowing fuse FS1. The power supply to the regulator Q1 can also be cut off by the microcomputer Q5 acting through the latch Q6 and a connection 86 between Q3 output of Q6 and the device Q3. A power fail/reset module 87 is provided to ensure that the microcomputer and memories operate safely during the appearance and disappearance of power and also to provide an advanced signal to the processing module 56 ensuring the correct sequence of events if there is a mains power failure. Redundancy of the circuit elements is provided to ensure that a single component failure within the module 87 does not prevent correct failure signal generation. Thus the line 84 from the power supply module 65 is connected to zener diodes D1, D2 in parallel to provide current to bias respective transistors T1, T2 into saturation. The bias current of D1 (D2) creates a voltage across resistor R1 (R2) to provide a base current for T1 (T2) via resistor R3 (R4) which protects the transistors from excessive drive. These diodes and resistors are chosen to ensure saturation of T1 (T2) under all normal power up conditions. A "0" at the collector of T1 (T2) is converted to a "1" in a low power inverting buffer 10/1 (5/1). The outputs of these two buffers are combined in a NAND gate 11/1 to interrupt the microcomputer action at port INT by way of an inverting buffer 10/2. The output of 10/1 (5/1) is connected via resistors R7, R11 (R8, R12), diode D5 (D6) and capacitor C2 (C3) to one input of NAND gate 11/2 (11/3). This is a Schmitt trigger NAND gate that ensures that slow changes on its inputs produce fast clear transitions on its output. When the output of buffer 10/1 (5/1) changes from "0" to "1" at power up, C2 (C3) changes via R7, R11, (R8, R12) until the threshold of gate 11/2 (11/3). The output of 11/2 then changes from "1" to "0" because its other input is held by resistor R15 to the +5 line voltage at "1". The transition of 11/2 from "1" to "0" allows capacitor C2 to discharge via resistor R7 and diode D5 until the low threshold is reached and the output of gate 11/2 alters from "0" to "1". The discharge time of C2 is thus quicker than its charge time. The output of gate 11/2 is inverted in an inverting buffer 5/2 to produce the "1" level for X microseconds after power up and the "0" level Y microseconds after power down. The output of the inverting buffer 5/2 provides the other input to the gate 11/3 which does not change state until both inputs are at "1" so that it is the slower of the two timing circuits R11, D5, C2 and R12, D6 C3 that is dominant at power up. This differs from the power down condition when it is the timing circuit that discharges faster than controls gate 11/3. The output of gate 11/3 is inverted by an inverting buffer 10/3 which feeds, on the one hand, a low pass filter and on the other hand, another gate combination 11/4, 5/3. The signal from gate 5/3 goes to an input CLR to clear the latch Q6. The low pass filter comprises capacitors C6, C10, C11, inductors L1, L2, resistor R16 and diode D11 and its output is connected to the reset input RESET of the microcomputer. Clearly there is a predetermined delay between the interrupt signal through buffer 10/2 and the clear and reset signals through buffer 10/3. The primary purpose of the filter is to remove any spurious transitions from gate 11/3 or 10/3 that may occur as the +5 volt supply to the system rises to its normal operating level. The danger of a false reset signal arising prior to an interrupt signal is avoided. The filter also provides good filtering of general system noise, "cross-talk" and radiated bursts of noise at higher frequencies. The input of gate 11/2 connected to R15 also provides a convenient point to produce a reset signal during fault finding or servicing without having to switch off the meter. The power fail/reset module also provides adequate component failure detection, thus ensuring a complete shutdown of the meter to protect the memories. This is achieved by a combination of circuit design, with the utilisation of few locations in the memories to store component dependent timing flags, and by the execution of a fault tolerant/safeguard algorithm by the microcomputer. In general, the redundancy of the circuit elements is provided to ensure that a single component failure either does not prevent the emergence of the correct failure signal INT at switch off, or does not prevent the generation of the RESET signal during switch on and switch off. There are some failures which may disable the microcomputer and the memories indefinitely but since these failures are not in anyway deleterious to the contents of the memories, they are considered as safe failures. As in the memory modules, the gates of different packages are arranged in such a way that a failure of a single gate or failure of a complete package does not produce deleterious effects. The timing flags assigned to combinations of components such as R7, R11, D5 and C2, along with other variant flags, are stored in the nonvolatile memories Q2, Q4 before shipment of the meter. These flags are received by the microcomputer at switch on and compared with the flags stored in the ROM and any mix-match is interpreted as a failure. If there are no failures, the flags are negated and written back to the memories. At switch off, the time between the emergence of a power failure signal at the INT input of the microcomputer and a RESET signal at the RESET input of the microcomputer is divided into segments assigned to the aforementioned flags respectively. At switch off, these time segments are simulated inside the microcomputer by the timer/counter in the microcomputer and generate an alarm inside the microcomputer after the elapse of each time segment. When there are no faults and when power is switched off, the microcomputer, after elapse of each time segment, re-negates the assigned flags in the memories to their true states. It is, therefore, clear that the premature emergence of the RESET signal would have prevented the microcomputer from re-negating one or more of the aforementioned flags. Thus the un-modified flags would be detected at switch on and interpreted as failures and necessary action taken by the microcomputer. The absence of the RESET signal after a predetermined time is also interpreted as a failure. The component values of R7, R11, C2, R8, R12 and C3 are selected such that they provide a temporary cushioning effect under some failure conditions, i.e., the microcomputer and the memories are initialised safely even if there are some multiple failures such as D5 and D6 becoming short circuited. To enhance the failure detection, an additional output feeds into the microcomputer at PO5. This line has its' origins at gate 11/1 and enables the microcomputer to do adequate diagnosis. The diagnosis relies on the fact that failures of any component such as T1, T2, D1, D2, 10/1 5/1, 11/1 and, to some extent the failures of R1, R3, R5, R2, R6 would manifest as a fault at the output of 11/1. The output state of gate 11/1 has a different significance at various time frames during system operation. i.e., power-up, power-on and power-down. Any anomaly is again interpreted as failure of the module, for example if the microcomputer continuously sampled a logic "1" at PO5, but both INT and RESET were absent for a predetermined time. It will be seen that FIG. 11, in addition to circles shown connected to various lines in the circuit which indicate memory and service interface test points, there are rectangles representing electronic weigh scale interface connections, and a number of broken circles which represent switches, for circuit isolation during fault diagnosis. Each memory Q2 or Q4 is provided with an interface connector to enable diagnostic equipment to be connected for direct interrogation during a fault state or for diagnostic purposes. An important feature of the solid state circuitry shown in FIG. 11 is that it can all be incorporated on one printed circuit board but a preferred solution is to use two printed circuit boards 70, 71 as shown in FIGS. 3 and 4 located on top and on one side of the meter where they are readily accessible and occupy very little space. The two printed circuit boards are joined by conductor 72 that may be provided by a flexible printed circuit board or some other connecting means. This particularly neat arrangement is primarily due to the fact that the contact strips of the encoding switches are integral with the printed circuit board 70 and the rotary parts 46 of these switches are rotatably mounted directly on the board 70. This printed circuit board also carries the push buttons 29 to 32, the alphanumeric display and the associated solid state units while the board 71 carries the microcomputer, memories and associated solid state units. A socket 73 is provided for external access to the electronic system and a socket 74 is provided for mounting the franking meter on the base of the machine which carries the means for transporting and controlling the items of mail to be franked. Turning now to what may be described as the software side of the system, so that the actual organisation of the system can be appreciated, the microcomputer Q5 has a ROM that incorporates meter software modules that maintain the various working registers which are mainly relevant to the timing aspects of the information gathering and output. The remainder of the ROM maintains information which collectively describes the total system status. Within the system status a distinction can be made between the metering status and peripheral status. The metering status is maintained by registering information contained in a RAM of the microcomputer Q5 pertaining to the monetary standing of the customer, e.g., credit, postal value used, number of mail items franked, as well as the meter's integrity, e.g., fault conditions. This information is copied into the RAMs Q2 and Q4. The peripheral status is concerned with the communications link between operator and machine which depends on the thumb wheels, push buttons and the display. The contents of the peripheral status registers in the microcomputer provide an interpretation of these peripherals at any instant. Since change of status of these peripherals is unpredictable from the point of view of the microcomputer, this interpretation is the result of continuous scanning. Decisions pertinent to the meter functioning are based primarily on the information in the peripheral status registers and also on the status of flags in a flag bank shown in tubular form in FIG. 15. The software reacts instantaneously to changes in peripheral status, whereas a flag is considered only when a go/no go situation arises. A map of the flags and other areas of the microcomputer appears in FIG. 16. The software hierarchy is shown in FIG. 13 which shows there are five main modules. The real time relationship between these is shown diagrammatically in FIG. 12. Here the arrows indicate the direction of progression rather than time flow. Progression around arrowed lines is considered to occur in zero time. Referring to FIG. 12, the "power-up module" restores the metering status in the microcomputer to that which existed just prior to the last power down, i.e., the input from the battery maintained memories. The "scanner module" gathers information from the peripheral systems and outputs status information to the display. This module primarily maintains the peripheral status registers and performs diagnostic operations. Timing aspects of the scanner module are indicated in FIG. 14. The "account module" controls the input to and output from the metering status whilst also maintaining records pertinent to the customer's account history. The "memory input/output module" controls transfer of data between the microcomputer data memory and the external support memories Q2 and Q4. The "power down module" ensures that the metering status, as it was just before a power failure being anticipated, is properly stored in the support memories Q2 and Q4. Diagnostic routines operate continuously during power on within the scanner module to protect the metering status against pollution and accounting error. For the support memory, the diagnostic is effected by data coding techniques involving the addition of checking bits and also upon comparison operations with the microcomputer's data memory. The check bits are removed upon memory read and are such that at least 3-bit errors are required within a word to have a chance of degenerating into another valid word. In the comparison check each support memory is independently comparable with the microcomputer data memory. The thumb wheel diagnostic relies for its integrity upon the encoding switches described above. The software distinguishes between invalid codes which are non-fatal (e.g. intermediate wheel positions) and those which are fatal (e.g., short or open circuits). Non-fatal codes inhibit the franking cycle without causing the meter to enter a "fault" mode as would a fatal code. The diagnostic performs a checksum calculation on the microcomputer's programme memory and in addition does test arithmetic calculations that emulate those performed during a franking cycle account. The power fail circuit diagnostic makes use of the power status inputs to confirm, or otherwise, the power on or power fail condition.
|
Same subclass Same class Consider this |
||||||||||