Abstract:
In a method and an apparatus for transferring customer data stored in a non-volatile manner in a franking machine for backup purposes, a customer card is inserted in a card reader and a processor of the franking machine transfers data from a non-volatile memory in the franking machine to the customer card in the card reader.

Description:
BACKGROUND OF THE INVENTION  
       [0001]     1. Field of the Invention  
         [0002]     The present invention concerns an arrangement for transferring, for backup purposes changing of customer data that are stored in a non-volatile manner in a franking device of the type wherein client-dependent data (such as, for example, clichés and cost center data) are stored in a non-volatile manner in a memory of the franking device and must be saved from data loss in the case of repair. Such a franking device can be a commercial franking machine or a personal computer that is operated as a PC franker and that controls a commercial printer.  
         [0003]     2. Description of the Prior Art  
         [0004]     A postal fee billing system is known from German Published Application DE 39 03 718 A1 (corresponding to U.S. Pat. No. 5,111,030). Franking machine usage information is written to a chip card or read out therefrom. A transfer of data stored in first hardware to second hardware is, however, not possible in the case of defective hardware.  
         [0005]     A method and apparatus for monitored controlled downloading of graphical images from a portable apparatus into a franking machine system is known from U.S. Pat. No. 6,085,180. For image data transfer, image data are stored in a portable device and are loaded in a controlled manner into a franking machine. The apparatus concerns only image data and is not connected to only one specific franking machine, i.e. the image data are not customer-specific.  
         [0006]     A method and an arrangement for input of a printing stamp into a franking machine is known from the German Published Application DE 199 13 066 A1. In the franking machine of the type Jetmail® (manufacturer Francotyp Postalia GmbH), a preparation of a set of different country-specific and/or carrier-specific post stamp data ensues in a non-exchangeable memory of the franking machine in a first step and a configuration for a carrier and for a country in which the franking machine should be used ensues at the manufacturer in a second step. The configuration ensues by transmission of data by means of the integrated interface, in particular by means of a chip card via a chip card read/write unit of the franking machine. Data can be input into the franking machine in this manner. Either print images are transferred into the franking machine via an interface (for example chip card) or print images already present are selected for use. The data are not transferred from the franking machine to the chip card, and thus the chip card does not represent an updatable memory for print images.  
         [0007]     An exchange of data without interconnected transfer means is known from the European Patent EP 560 714 B1 (corresponding to U.S. Pat. No. 5,509,117). To secure postal accounting data, a defective (old) installation unit is exchanged for a non-defective (new) installation unit, and the data of the old installation unit are transmitted to the new installation unit after both have been interconnected together via plug connectors. However, a data memory cannot be exchanged individually but rather only together with the installation unit.  
         [0008]     A security module placed in a security region, the security module being plugged into the mainboard (motherboard) of the meter of the franking machine of the type JetMail® and that contains the accounting data, is known from the German design patent DE 200 20 635 U1. Other customer-dependent data (such as, for example, cliché and cost center data) are stored in a non-volatile manner in a separate memory of each franking machine. A franking machine of the type JetMail® has a meter assembly group and a base assembly group. The meter housing is fashioned as a security housing for protection of the mainboard. Since the battery-buffered memory units used in the meter still exhibit a DIP housing, they could be plugged into corresponding sockets on the mainboard and are therefore easily exchangeable in the case of repair. However, pluggable memory ICs (for example in a DIP housing) are problematic due to possible problems as to availability, lower capacity and limited expansion capability.  
         [0009]     Such memories are no longer available with capacity sufficient for the subsequently developed franking machines. The exchange of defective mainboards is made more difficult by the transition from pluggable memory modules (DIP housing) to permanently soldered memory ICs in SOP, TSSOP or BGA housings since the customer-dependent data (for example cliché, cost centers) cannot be transferred from one mainboard to another without further measures. Although this transfer was still possible in the franking machine of the type JetMail® via a plugging of the battery-buffered memory, since memory in the DIP housing could still be used, for a franking machine of the type Ultimail software was created with whose help the data can be transferred from the franking machine into a service computer or personal computer (PC) via a serial data connection. The customer data thus can be changed in franking machines. If, for example, a defective mainboard of the franking machine must be exchanged for a new mainboard, the customer data are first transferred from the franking machine to a service computer via a serial data connection and then are copied from the service computer into the memory of the new mainboard after the mainboard exchange. However, this procedure cannot be applied in the case of a mainboard that is so defective that the data cannot be transferred from the service computer. In this case no data can be salvaged and an increased effort must be made in order to repair the franking machine.  
       SUMMARY OF THE INVENTION  
       [0010]     An object of the present invention is to provide an arrangement for exchanging customer data that are stored in a non-volatile manner in franking devices wherein the customer data are transferable with relatively little effort from a defective mainboard to another, non-defective mainboard.  
         [0011]     The object is achieved in accordance with the invention by an arrangement for exchanging customer data, wherein a customer card is provided that can be plugged into a socket of a franking device as a backup medium for customer-specific data used by the franking device. The socket is connected with corresponding connections (contacts) of a processor of the device in order to serially transfer the customer data via the socket and to store the data there in a non-volatile manner. The transfer ensues with a high speed via an assembly group for protection of the customer card from destruction by electrostatic discharge (ESD). These customer can be: 
        cost center data     advertising cliché data     SMS text data     abbreviated dialing data     optional printing: statistical data     optional printing: cliché data     class of mail data or also     postage table data        
 
         [0020]     The use of a commercial memory card (such as, for example, MultiMedia Card (MMC)) as a customer data memory offers the following advantages: 
        Very high costs can be precluded relative to the costs in the development of an alternative module.     The management is unproblematical relative to that given the pluggable memory ICs (for example in a DIP housing) since ESD factors are considered. A relatively complicated infrastructure for reading and writing would also be necessary given a memory IC in a DIP housing.     A new development of a necessary infrastructure for reading/writing outside of the franking machine is no longer necessary.     The availability, manufacturing costs, development costs, manageability, capacity and its expandability of the module are approaching optimal: 
            Availability: MMCs are standardized and contained in many consumer products. The long-term availability is thereby provided. Given use of the MMC standard on the software driver level, a plurality of alternative manufacturers can be resorted to.     Manufacturing costs: The costs per Mbyte drop relatively steadily and quickly. One profits, so to speak, from the general development in the photo market and other technical fields.     Development costs: The development costs are relatively low. Modern processors (for example the Intel XScale) already possess an MMC controller on-chip. On the SW side, finished file systems for the employed operating system can be integrated. The development costs for the infrastructure are also low: the advantage here is the availability of commercial card reader devices. When a file system is used on the SW side, with a PC and a reader device standard Windows SW (Windows Explorer) can be used on the part of the service in order to read and to write to the MMC.     Manageability: Simple, and the card itself can be handled without ESD protection. A plurality of variants are conceivable with regard to the accessibility (accessible by the user or not).     Capacity and its expandability: The memory capacity of the smallest (still) customary MMC (32 Mbytes) is already more than sufficient for the considered usage purpose. The expandability of the capacity to more than 512 Mbytes is possible for new application cases.    
               
 
         [0030]     The present invention also concerns a method for backing up customer data in a franking device wherein the data are backed up to a customer card, such as a MultiMedia Card (MMC). 
     
    
     DESCRIPTION OF THE DRAWINGS  
       [0031]      FIG. 1  is a perspective view of a known franking machine of the type Jetmail® from the front right top.  
         [0032]      FIG. 2  is a block diagram of the electronics of the franking machine of the type Jetmail®.  
         [0033]      FIG. 3  is a block diagram of the electronics of an embodiment of a franking machine in accordance with the invention.  
         [0034]      FIG. 4  illustrates stages of an exchange of the PSD and an MMC of a defective franking machine.  
         [0035]      FIG. 5  is a perspective view of a franking machine in accordance with the present invention from the front right top.  
         [0036]      FIG. 6  is a rear view of the new franking machine of  FIG. 5 .  
         [0037]      FIG. 7  is a flowchart showing steps in the method according to the present invention for determining the machine state of a franking device in which a MultiMedia Card is used for backing up customer data.  
         [0038]      FIG. 8  is a flowchart for recovery management that occurs after determining the machine state in accordance with the present invention.  
         [0039]      FIG. 9  is a flowchart for evaluating whether data backup is needed after executing the recovery management routine in accordance with the present invention.  
         [0040]      FIG. 10  schematically illustrates the action that is taken when case  1  is encountered in any of the routines shown in  FIGS. 7, 8  and  9 .  
         [0041]      FIG. 11  schematically illustrates the action that is taken when case  2  is encountered in any of the routines shown in  FIGS. 7, 8  and  9 .  
         [0042]      FIG. 12  schematically illustrates the action that is taken when case  3  is encountered in any of the routines shown in  FIGS. 7, 8  and  9 .  
         [0043]      FIG. 13  schematically illustrates the action that is taken when case  4  is encountered in any of the routines shown in  FIGS. 7, 8  and  9 . 
     
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0044]     A perspective view of a known franking machine of the type Jetmail® from the front right top is shown in  FIG. 1 . In a basic version the franking machine JetMail® includes the assembly groups meter  10 *, Base  20 * and tray  40 *. The meter  10 * has on the top side a user interface with a display unit and a keypad. A security module and battery-buffered memory are plugged into the mainboard (not visible) within the meter, which has a security housing. The meter  10 * is fashioned such that it can be removed from the base  20 * and then is accessible from its floor, assuming a repair. If a defective meter  10 * is removed, before it is scrapped, the battery-buffered memory and the security module are extracted and then plugged into the mainboard of a second (new) meter. The new meter is subsequently installed.  
         [0045]     A block diagram of the electronics of the franking machine of the type Jetmail® is shown in  FIG. 2 . A processor  1 * on the mainboard  11 * is connected (in terms of data, control and addressing) with an external interface  13 * via a driver  12 * and via a bus  5 * with a socketed battery-buffered memory (NVRAM)  6 *, with a postal security module (PSD)  7 *, with a static RAM as a volatile working memory  8 * and with a program memory (Flash)  9 *. The NVRAM  6 * serves for the storage of customer-specific data and therefore has a correspondingly large memory capacity. The PSD and the NVRAM  6 * are plugged into respective corresponding sockets of the mainboard  11 * of the meter  10 *. The external interface  13 * is a chip card read/write unit.  
         [0046]      FIG. 3  shows a block diagram of the electronics of a franking machine in accordance with the invention corresponds with the basic design shown in  FIG. 1  with the following differences. The integration of an MMC  4  into the electronics (assembly groups  1  through  9 ) of the mainboard  11  of a franking machine can be realized without a problem when modern processors  1  are used that already possess an MMC controller on-chip. The assembly group MMC socket  3  has a sufficient protection from destruction by electrostatic discharge (ESD) via a corresponding assembly group  2 . Electromagnetic compatibility (EMV) and signal integrity factors can therewith be taken into account since the data transfer rate is up to 20 MHz. The data transfer rate is therewith more than an order of magnitude above that data transfer rate that is customary with chip cards.  
         [0047]     Primarily the corresponding port pins of the processor  1  are connected with the MMC socket  3  via the ESD protection assembly group  2 . Furthermore, via drivers  12  an interface  13  can optionally be enabled at the processor  1 , for example a chip card read/write unit. The connections and the aforementioned optional assembly groups are marked with dash-dot lines.  
         [0048]     The customer card MMC  4  is used as a backup medium for customer-specific data (cost center data, cliché data, optional print cliché data, class-of-mail data and postage table data as well as SMS-like short texts, abbreviated dialing and optional printing: statistics). In slower franking machines the processor is operated programmed by a first program stored in the program memory (flash)  9  such that altered data can be directly updated on the customer card MMC  4 .  
         [0049]     However, when the franking machine is a high-capacity franking system, all customer data cannot be immediately written to the customer card after each letter. The processor  1  is connected (in terms of operation) with a non-volatile memory (NVRAM)  6  permanently soldered onto the mainboard  11 , which non-volatile memory  6  exhibits a low storage capacity, and said processor  1  is operated programmed by a second program stored in the program memory (flash)  9  such that, for example, the currently set cost center is loaded into the NVRAM  6  before the current data are stored in this NVRAM  6 . The data are updated on the customer card in time intervals, for example when a print pause is achieved or the machine was just activated or deactivated. The process is correspondingly programmed for this. This method is distinctly quicker since the current altered data are transferred in parallel from the bus  5  and are buffered in the non-volatile memory (NVRAM)  6  between the time intervals.  
         [0050]     Stages of an exchange of the PSDs and an MMC of a defective franking machine are shown in  FIG. 4 . At a first point a first defective franking machine FM A is shown from which a PSD  7  and an MMC  4  (which are shown at a second point) are taken. The PSD  7  contains accounting/billing data and the MMC  4  contains the customer data. A second, non-defective franking machine FM B into which the extracted PSD  7  and MMC  4  were inserted is shown at a third point.  
         [0051]      FIG. 5  shows a perspective view of the inventive franking machine FM A from the front right above. In contrast to the franking machine of the type Jetmail®, no meter/base separation exists. The electronic components (likewise MMC and PSD) are arranged within the security housing of the new franking machine. After opening the security housing, the plugged assembly groups (customer card (MMC) and security module (PSD)) can be exchanged quickly.  
         [0052]     An optional chip card  50  can be plugged into a chip card write/read unit that is arranged such that is accessible on the left half of the housing top  23  of the franking machine, behind a protective panel  21 . The franking machine can be equipped with an automated sealer  30  (shown) and further mail stations (not shown) such as, for example, with an automatic feed in the periphery.  
         [0053]     A rear view of the new franking machine FM A is shown in  FIG. 6  from the rear, left, above, from which franking machine FM A the housing of the rear side has been removed. The components MMC  4  and PSD  7  are visible through this and through a section in a covering, which components are arranged near the rear wall of the new franking machine on the mainboard.  
         [0054]     An envelope (not shown) or another mail piece standing on edge can be transported in a shaft that is bounded on its sides by the protective panel  21  and a guide plate  22 . The printing of the mail piece with a franking stamp image ensues without contact by means of inkjet technology during the mail piece transport. The billing or accounting data are cryptographically secured with keys from the PSD.  
         [0055]     The non-volatile memory  6  arranged on the mainboard  11  of the franking machine is, for example, a battery-buffered NVRAM. As an alternative to this, other non-volatile memory technologies (FRAM, NVSRAM) can also be used.  
         [0056]     The MMC is operationally connected with the processor. Solutions are also conceivable in which a programmable logic (such as, for example, a Spartan-II 2.5V FPGA from the company XILINX or an application-specific integrated circuit (ASIC)) is connected in-between.  
         [0057]     In a further embodiments of the invention, the customer data are also cryptographically secured with keys from the PSD. The encrypted customer data can additionally comprise an association of the customer data with the serial number of the PSD.  
         [0058]     An MMC with customer data can also be plugged into a personal computer PC when the PC exhibits a corresponding interface. The security module which is designated for use in postal apparatuses can also exhibit a different design that enables it to be plugged into the mainboard of a personal computer, for example, to allow the personal computer to be operated as a PC franker and control a commercial printer.  
         [0059]     A procedure for backing up customer data stored in a franking machine, making use of an MMC in a card reader of the franking machine is shown in the flowcharts of  FIGS. 7-13 .  
         [0060]      FIG. 7  illustrates a procedure that is executed before state determination, namely before the determination of the machine state. A number of checks is performed to ensure that the system is functioning properly. In  FIG. 7 , as well as in  FIGS. 8 and 9 , exit possibilities  1 ,  2 ,  3  and  4  are indicated in circles, the results of those exit possibilities being respectively shown in  FIGS. 10, 11 ,  12  and  13 . Exit case  1  can be considered to be a normal startup, exit case  2  is a startup into the service mode, exit case  3  represents an MMC defect, and exit case  4  is an emergency shutdown.  
         [0061]     The portion of the procedure illustrated in  FIG. 7  starts in step  60  and checks, in step  61 , whether the mainboard data are correct. If not, exit to the case  4  situation occurs. If the mainboard data are determined to be correct, a check is made in step  62  as to whether a recovery is in progress. If not, again an exit to case  4  is made. If so, a check is made in step  63  as to whether a security device is present. If not, the routine exits to case  2 . If it is determined that a security device is present, a check is made in  64  as to whether the MMC is present. If not, the routine exits to case  3 . If the MMC is present, a check is made in step  65  as to whether the MMC format is correct. If not, an exit to case  3  is made. If the MMC format is correct, an MMC checkdisk subroutine is executed, and if a “not recoverable” result occurs, and exit to case  3  is made. If the MMC checkdisk subroutine executes properly, a check is made in step  67  as to whether the OEM information is correct. If not, an exit to case  3  is made. If the OEM information is correct, then in step  68  the machine state is determined, as are the applicable case and any action that needs to be taken, as exemplified by the procedure illustrated in the flowchart of  FIG. 8 .  
         [0062]      FIG. 8  begins with the same ending step  68  from  FIG. 7  that is designated step  70  in  FIG. 8 . The routine shown in  FIG. 8  then proceeds to step  71 , wherein it is determined whether the machine state has changed. If so, the appropriate case among case  1 , case  2  or case  3  is exited to, and appropriate information is displayed in step  72 . If the machine state has not changed, an inquiry is made in step  73  as to whether an action is required. If not, the routine exits to case  1 . If an action is required, an inquiry is made in step  74  as to whether the state is invalid. If not, an exit to case  4  is made. If yes, the routine proceeds to step  75  wherein an inquiry is made as to whether the access level is sufficient. If not, the routine exits to case  4 . If the access level is sufficient, a check is made in step  76  as to whether initialization is required. If so, the routine proceeds to step  77 , wherein the MMC is initialized. If no initialization is required, an inquiry is made in step  78  as to whether the MMC lifetime has been exceeded. If so, the routine exits to case  3 . If not, in step  79  a backup is initiated.  
         [0063]      FIG. 9  shows the remainder of the procedure in a flowchart that begins with the same step as the ending step in  FIG. 8 , designated step  80  in  FIG. 9 . Following step  80 , an inquiry is made as to whether a backup is in progress. If not, it is checked in step  82  whether a backup exists. If so, and if a backup is in progress, it is determined in step  82   a  whether to proceed. In step  83 , it is determined whether the machine is in case  2 , and if so the dobackup routine is run. If this is unsuccessful in step  83   a , the routine proceeds to step  84  wherein it is again determined whether backup is needed, and if so a check is made in step  84   a  to use exiting or available backup data in step  84  or to create new backup data in step  84   c.    
         [0064]     In step  85 , it is checked whether the startup is normal with no errors, and if so the backup data are tested in step  85   a . If the startup is not normal or if errors are detected in step  85 , then in step  86  an inquiry is made as to whether any recovery action is needed. If so, the data are recovered in step  86   a . If not, a check is made as to whether any defect in the MMC exists, and if not the routine exits to case  3 , and if so the routine exits to case  1 .  
         [0065]     The results of the respective exit cases are shown in  FIGS. 10-13 . As schematically indicated in  FIG. 10 , the result of exit case  1  is normal startup in step  90 . The result of exit case  2  is startup in a service mode in step  91 . The result of exit case  3  is to mark or otherwise indicate the MMC as being defective in step  92 , and to display appropriate information in step  93 , followed by an exit to case  1 . Exit case  4  proceeds in step  94  with a display of appropriate information and a shutdown of the franking machine in step  96 .  
         [0066]     Although modifications and changes may be suggested by those skilled in the art, it is the intention of the inventors to embody within the patent warranted hereon all changes and modifications as reasonably and properly come within the scope of their contribution to the art.