Franking machine

Abstract: A franking machine is disclosed in which the accounting and control circuits (12) of the meter are housed in a secure housing (11) and a printing device (20) for printing a franking impression is located exterior to the secure housing and is connected to the accounting and control circuits. Strings of print data sent to the printing device are returned in a succeeding print cycle to a check circuit (31) in the housing to check integrity of the print data received by the printing device. If desired the print data strings may include a security code. In order to detect if the printing device has been disconnected from the meter, the meter includes a circuit (44) to send a pulse train to the printing device (20) via the connection (26) for print data and to receive a pulse train from the printing device. The circuit (44) compares the pulse trains and if the comparison is unsuccessful inhibits further franking operations.

Description: This invention relates to franking machines and in particular to such machines provided with franking printing means controlled by electronic accounting and control means to maintain an accounting record of data relating to franking impressions which have been printed. Known franking machines utilise a mechanically operated print drum to print franking impressions. The print drum carries settable print wheels for printing the value of franking and the date of franking. The setting of the print wheels, and hence the value of the franking impression printed, is controlled by a franking meter which includes means for carrying out accounting functions in respect of usage of the meter in franking operations. Usually the meter includes a descending register which is reset to record a value of credit available for use in franking and in each franking operation this register is decremented by the value of franking impression printed. The accumulated value of franking used in franking operations is registered in an ascending register, this register being incremented in each franking operation by the value of franking printed. Mechanical interlocks are provided to prevent fraudulent attempts to operate the printing mechanism independently of control by the meter and to prevent fraudulent attempts to reset the print wheels to print a franking value different from that registered by the meter. In EP-A-0 018 081 there is disclosed a postage meter system in which the printing station is separated from the accounting station and is connected to the accounting station by an insecure communications link. Each time the printing station is tripped for postage to be printed, a number is sent by the printing station to the accounting station and the printing station encrypts the number. Upon receipt of thee number the accounting station carries out accounting functions in respect of the postage to be printed. The accounting station encrypts the number and returns the encrypted number to the printing station where the encrypted number is compared with an encryption of the number effected at the printing station. If both encrypted numbers match it indicates that the postage to be printed has been accounted for and the printer is activated. With the availability of electronically operated printing devices such as thermal print heads and ink jet print heads, it is desirable to replace the mechanical drum print mechanism with electronically operated print devices in order to provide greater flexibility in printing and to avoid the need for complex and expensive electromechanical interfaces between the electronic accounting and control circuits and the mechanical print elements of the drum printer. However such electronically operated printing devices could be operated by the external application of electrical signals to the print head elements or the drive circuits thereof and hence may be capable of being operated in a fraudulent manner. Accordingly measures must be taken to ensure security of the printing of franking impressions and the accounting thereof. One method of overcoming this problem is to house not only the meter circuits but also the printer, the drive circuits therefor and the interconnections between the meter and the printer in a secure housing. This has the disadvantage that, if a fault arises in the printer, repair of the fault requires access to the secure housing and as a result the postal authority may require the integrity of the accounting records maintained in the meter to be verified prior to re-use of the machine. It would be advantageous to place within the secure housing only those circuits concerned with performing functions for which there is a need for security and to house other elements of the franking machine externally of the secure housing thereby reducing the occasions when there is a need for access to the secure housing and to take measures to ensure that elements of the franking machine, such as the printer, housed externally of the secure housing cannot be operated in a manner to cause printing of a fraudulent franking. According to the invention a franking machine including a printing unit for printing franking impressions on mail items; an accounting unit including electronic accounting circuits operative to maintain a record of data relating to values of franking printed by the printing unit on mail items; a secure housing containing said accounting circuits; said printing unit being located externally of the secure housing and connected to the accounting circuits by an insecure connection; code signal generation means in one of the units to generate a code signal for transmission to the other unit via the connection and comparison means in the one unit to receive from the other unit a returned signal in response to said code signal and to effect a comparison in respect of the code signal and the returned signal and in response to the comparison being unsuccessful inhibiting operation of the one unit is characterised in that the code signal generation means and the comparison means are located with the accounting circuits in the secure housing; that the accounting circuits generate a print data signal defining a franking impression of selected postage value to be printed; that encoding means combines the code signal with the print data signal and that the print data signal combined with the code signal is transmitted via the connection to the printing unit; said printing unit being operative in response to the print data signal to print a franking impression defined by the print data signal and to return the print data signal and the code signal to the comparison means located in the accounting unit; said comparison means being operative to compare the code signal returned from the print unit with the code signal transmitted to the printing unit and to the returned print data signal returned from the printing unit with the print data signal transmitted to the printing unit and being operative to inhibit further operation of the accounting means in response to failure of the comparison. An embodiment of the invention will now be described by way of example in which:- Figure 1 is a block diagram of a franking machine, Figure 2 is a block diagram of a comparison circuit, Figure 3 is a modification of a part of the block diagram of Figure 1, and Figure 4 shows a modification of the print head circuit. Referring first to Figure 1, a franking machine includes a franking meter 10 having accounting and control circuits housed in a secure housing 11. The accounting and control circuits include a microprocessor 12 and non-volatile memories 13, 14 for storing accounting data. Memory 13 includes descending and ascending registers for registering respectively the value of credit available for franking and the accumulated value of franking used. The memory also includes an items count register for registering the number of mail items franked and a high items count register for registering the number of mail items franked with a franking value exceeding a predetermined value. The aforementioned registers of memory 13 are duplicated so that the data is registered in duplicate. The memory 14 is similar to memory 13 and includes a further set of registers in duplicate thereby permitting the credit value, accumulated tote value, items count and high items count each to be stored in four different registers. This replication of registers ensures that the integrity of the stored data can be verified and in the event of corruption of data in any one of the registers the data can be restored from that stored in the corresponding registers. The franking machine also includes, externally of the secure housing 11, a further microprocessor 15 for receiving input data entered by a user of the machine on a keyboard 16 or received via a communication interface 17. The microprocessor 15 controls a display device 18 to display data and information signals to the user of the machine. To enable communication between the microprocessors 12 and 15 a bus connection 19 is provided. A print head 20 operable to print franking impressions on mail items is connected to the circuits in the secure housing as will be described hereinafter. Feeding means 21 including a drive motor is provided to feed mail items one at a time past the print head to enable franking impressions to be printed thereon. The drive motor of the feeding means is energized under control of a control circuit 22 operated by the microprocessor 15. The electronically operated print head 20 comprises a row of thermally operated print elements 23 which are heated by passage of electric current therethrough controlled by the data content of corresponding stages of a print buffer 24. For example, a binary '1' in a stage of the print buffer results in the corresponding print element being energized and heated whereas a binary '0' leaves the corresponding print element un-energised. A serial memory 25 receives print data serially via a print data input line 26 from the meter 10, the print data being clocked into the memory by clock pulses on line 27. The stages of the serial memory 25 correspond to and are connected by gates to the stages of the print buffer 24. When the serial memory is loaded with a string of print data, opening of the gates by a load print data control signal 28 causes the print data to be read from the serial memory and to be loaded in parallel to the stages of the print buffer 24 to set the stages thereof to correspond to the string of print data. A print strobe signal 29 applied to the print buffer causes the print elements 23 to be energised in dependence upon the binary value of the contents of the corresponding stages of the print buffer and hence selected print elements are heated to print dots along a line in positions determined by the print data. When print data corresponding to a line of printing is clocked into the serial memory 25, the previous content of the memory, corresponding to a previous line of printing is clocked out on a serial data output line 30. Thus as data corresponding to the dot pattern for one line is clocked into the serial memory, the data corresponding to the dot pattern for the previous line is clocked out on line 30. The meter includes a check circuit 31 which receives the print data sent to the print head on line 26 and the data clocked out on line 30 from the serial memory 25 and carries out a comparison to test for identity between the print data sent, on line 26, and data returned on line 30. Due to the data string returned from the serial memory being delayed relative to the sending of that data string to the serial memory the check circuit 31 includes means to store the string of print data sent until the returned data string is received. This may be effected conveniently by providing duplicate sets of registers for storing the print data strings and the returned data strings and duplicate comparison circuits operated alternately to compare corresponding sent and returned data strings. The check circuit is shown in more detail in Figure 2. The string of data corresponding to the dot pattern for a line transmitted to the print head on print data line 26 also is routed to one of a pair of registers 32, 33 of the check circuit 31 by gates 34, 35. The string of data read out serially from the serial memory 25 onto line 30 is routed by gates 36, 37 to one of a pair of registers 38, 39. The gates 34, 35 are operated to route the print data strings alternately to the registers 32, 33 and similarly the gates 36, 37 are operated to route the returned data strings alternately to the registers 38, 39 such that corresponding sent and returned strings are routed either to registers 32 and 38 or 33 and 39 respectively. Thus, for example print data strings representing the dot patterns of odd numbered lines are loaded into register 32 while print data strings representing the dot patterns of even numbered lines are loaded into register 33. A pair of comparators 40, 41 are operated alternately to compare the contents of the registers 32, 38 and registers 33, 39 respectively. If a returned data string corresponding to a sent print data string has identity with that sent print data string, the comparator 40 or 41 outputs a verification signal on line 42 to the microprocessor 12 to indicate that the print head received the correct print data string. On the other hand if the comparator does not find identity the verification signal is not output and the microprocessor terminates the printing of the franking operation and inhibits further use of the meter. While the circuits described hereinbefore ensure the integrity of the print data strings received by the serial memory of the print head, it may be desirable to provide an additional security to these data strings. For this purpose, the meter 10 includes an encoding device 43 operative to add a security code 55 to the print data strings. The print data strings would each include the security code at a predetermined position within the string. To accommodate the resulting longer strings, the serial memory 25 is provided with additional stages 51 which are not connected to the print buffer register 24. The security code is varied in a random or non predictable manner. The code may remain unaltered for the duration of printing an individual franking impression or may change during the printing of a franking impression. The code may consist of a random group of binary digits or may be formed from a combination of a random number and all or part of the string of print data. If it is desired to print the security code on the mail items the print buffer is provided with additional stages 52 connected to those stages 51 of the serial memory in which the security code is stored and corresponding print elements 53 are provided as shown in Figure 4. Instead of checking the entire data block i.e. the print data and the security code, sent to the print head, the check may be carried out on only part of the data block. For example the check may be carried out in respect of the security code only. Accordingly the registers 32 and 33 would store the security code sent to the print head and the registers 38 and 39 would store the security code returned from the print head. Checking only a part of the data block would enable economies to be made in the size of the registers and comparator circuits. If desired the entire data block comprising the print data and security code may be returned from the serial memory 25 to the print data check circuit 31, the print data being discarded and the security code being entered into the registers of the check circuit 31. Alternatively the circuits in the print head may be arranged to return only the security code on line 30 to the check circuit 31. Instead of checking the data blocks corresponding to each line, which as described hereinbefore requires the provision of two sets of registers and comparator circuits, checking may be carried out in respect of data blocks corresponding to alternate lines of print data. Accordingly this would require only a single set of registers and a single comparator circuit. The security measures described hereinbefore are effective to ensure detection of fraudulent attempts to operate the print head by means of signals applied externally to the print head or drive circuits thereof while the print head remains connected to the meter. However it may be possible to disconnect the print head from the meter in which case the print head could be operated independently of the meter. Accordingly the meter may be provided with means to detect any attempt to disconnect, even temporarily, the print head from the meter. The meter is provided with a connection check circuit 44 which includes a pulse train generator 56 apply a pulse train to the print data line 26. The print head includes a transistor switch 45 connected between the print data line 26 and the clock line 27. This transistor switch is normally in a low resistance state so that the print data line and clock line are interconnected. As a result the pulse train from the check circuit 44 on the print data line is returned on the clock line 27. The check circuit 44 is connected to the clock line 27 to receive the returned pulse train sand includes a comparison circuit 57 to compare the generated pulse train applied to the line 26 with the pulse train returned on clock line 27. If there is a match between the sent and received pulse trains the check circuit generates a signal on line 54 having a state indicating that the connection between the print head and meter is secure. However if at any time the comparison between the pulse trains fails, the state of the signal from the check circuit on line 54 changes to indicate that the connection has been broken and the signal remains in this state until the check circuit is reset by access to the secure housing. When the franking meter is in a franking mode of operation, prior to carrying out any franking the microprocessor 12 tests the state of the signal from the check circuit. If the signal on line 54 has a state indicating that the print head connection has been broken the microprocessor is inhibited from continuing the franking mode of operation. In its simplest form the check circuit may generate a uniform non-varying pulse train. However to prevent attempts to simulate the pulse train from an external source it is preferred that the check circuit generate a pulse train which varies in a non-uniform manner. It will be appreciated that the check circuit must remain operative even when the franking meter is switched off or disconnected from a mains electricity power source. Therefore the check circuit is permanently powered by a back up battery 46. This battery may be the same as that required to permanently power the non-volatile memories 13, 14. The interconnection of the print data and clock lines by the transistor switch 45 in its low resistance state prevents loading of print data into the serial memory. When a franking operation is to be performed the transistor 45 is switched to a high resistance state by a control signal on line 47. Thus any disconnection of the print head from the meter, except during the period of a franking operation, will be detected by the check circuit 44. If desired the testing of the connections between the franking meter and the print head may also be carried out during franking operations, the tests being carried out in suitable intervals between sending print data to the print head. While this provides security against attempts to disconnect the print head at any time, sufficient security may be provided by holding the transistor switch at a high resistance state for the duration that the franking machine is powered and allowing the switch to revert to its normal low resistance state when the machine is not powered by the mains electricity supply thereby detecting disconnection of the print head when the machine is not powered. A higher degree of security for the connections between the franking meter and the print head may be provided by the modified circuit shown in Figure 3. The connection check circuit 44 is the same as that of Figure 1 and this generates a pseudo-random waveform. A similar pseudo-random waveform generator 49 is provided on the print head 20. A master clock or synchronising signal is generated in the franking meter and this is utilized to clock the pseudo-random waveform generator 56 in circuit 44 and is transmitted by the line 27 to the generator 49 on the print head to clock generator 49. A system reset is generated every complete cycle of the pseudo-random pulse train to ensure that the pulse trains from circuit 56 and generator 49 are maintained synchronized. The pseudo-random pulse train from generator 49 is transmitted by line 26 to the comparison circuit 57 where it is compared with the pulse train generated by generator 56. It will be appreciated that the pulse train is transmitted on the line 26 which carries print data signals during franking operations in order to ensure that this line is not disconnected. Where required steering circuits are provided to steer signals along the required paths. The generator 49 on the print head is powered from the battery 46 by means of line 50. When it is desired to carry out a franking operation, the value of franking desired is entered on the keyboard and the microprocessor 15 passes this data to the microprocessor 12 in the secure housing and also causes the data to be displayed on the display device 18. The microprocessor 12 carries out a series of tests to check inter alia the state of the signal of the check circuit 44 and that the descending register is registering a credit value in excess of the value of desired franking. If all the tests are satisfactory, the microprocessor switches the transistor switch 45 to a high resistance state and outputs, one string at a time, strings of print data to the encoding device 43. A security code is added to the print data strings and the strings are transmitted to the print head and clocked into the serial memory for printing of lines of dots by the print elements. The mail item is fed by the feeding means 21 so that successive lines of printed dots build up a complete franking impression. Upon completion of the franking impression the mail item is ejected by the feeding means and the meter circuits return to a state to await the initiation of the next franking operation. In order to prevent corruption of data in the circuits of the meter in the secure housing by the application of over-voltage signals, the bus connection 19 between the exterior of the housing and the microprocessor 12 within the housing is protected by suppression circuits 48 using transorbs. Generally there is no need to protect the connections between the meter module 10 and the print head 20, but if desired these also may be protected by suppression circuits.

Claims: A franking machine including a printing unit (20) for printing franking impressions on mail items; an accounting unit (10) including electronic accounting circuits (12) operative to maintain a record of data relating to values of franking printed by the printing unit (20) on mail items; a secure housing (11) containing said accounting circuits (12); said printing unit (20) being located externally of the secure housing (11) and connected to the accounting circuits (12) by an insecure connection (26); code signal generation means (55) in one of the units (10) to generate a code signal for transmission to the other unit (20) via the connection (26) and comparison means (31) in the one unit (10) to receive from the other unit (20) a returned signal in response to said code signal and to effect a comparison in respect of the code signal and the returned signal and in response to the comparison being unsuccessful inhibiting operation of the one unit (10) characterised in that the code signal generation means (55) and the comparison means (31) are located with the accounting circuits (12) in the secure housing (11); that the accounting circuits (12) generate a print data signal defining a franking impression of selected postage value to be printed; that encoding means (43) combines the code signal with the print data signal and that the print data signal combined with the code signal is transmitted via the connection (26) to the printing unit (20); said printing unit (20) being operative in response to the print data signal to print a franking impression defined by the print data signal and to return the print data signal and the code signal to the comparison means (31) located in the accounting unit (10); said comparison means (31) being operative to compare the code signal returned from the print unit (20) with the code signal transmitted to the printing unit (20) and to the returned print data signal returned from the printing unit (20) with the print data signal transmitted to the printing unit (20) and being operative to inhibit further operation of the accounting means in response to failure of the comparison. A franking machine as claimed in any claim 1 further characterised in that the accounting unit transmits a series of print data signals to the printing unit; in that the printing unit (20) includes a memory (25) and means (28) to enter a first print data signal of said series of print data signals into the memory and to read a second print data signal preceding said first print data signal of the series of print data signals from the memory and to return said preceding print data signal read out from said memory (25) to the comparison means (31). A franking machine as claimed in claim 1 or 2 further characterised in that the comparison means (31) includes at least one register (32, 33) to store the print data signals transmitted to the printing device (20) until the corresponding print data signals returned by the printing unit (20) is received back from the printing unit (20). A franking machine as claimed in any preceding claim further characterised in that the printing unit (20) includes a print head including a row of a plurality of selectively operable printing elements (23) and in that each print data signal comprises a string of printing signals corresponding respectively to the plurality of selectively operable printing elements (23) to control operation of the printing elements to print dots forming a line of the franking impression. A franking machine as claimed in claim 4 further characterised in that the comparison means (31) includes first and second registers (32, 33) operable to store respectively one string and a next succeeding string of a succession of strings of print data sent to the printing unit (20); a third register (38) to store one string of print data signals returned from the printing unit (20) corresponding to said one string of print data signals transmitted to the printing unit (20); a fourth register (39) to store a next succeeding string of print data signals returned by the printing unit (20) corresponding to said next string of print data signals transmitted to the printing unit (20); first comparison means (40) operative to compare the contents of the first and third registers (32, 38) and second comparison means (41) operative to compare the contents of the second and fourth registers (33, 39), each first and second comparison means (40, 41) being operative in response to a successful comparison to output a verification signal (42) to the accounting circuit (12). A franking machine as claimed in any preceding claim further characterised by the provision of generator means (56) in said secure housing (11) operative continuously to generate a security signal; a first connecting line (26) carrying said security signal from the secure housing (11) to the printing unit (20); a second connecting line (27) carrying the security signal from the printing unit back to the interior of said secure housing (11); detector means (57) in said secure housing (11) connected to said second connecting line and operative in response to an absence of the security signal on the second connecting line to generate an inhibit signal (54) effective to inhibit operation of the franking meter. A franking machine as claimed in claim 6 further characterised in that the security signal comprises a train of pulses. A franking machine as claimed in claim 6 or 7 further characterised in that the generator means (56) is operative to generate a non-uniformly varying security signal and the detector means (57) is operative to compare the generated security signal with the security signal on the second connecting line; said detector means (57) being operative in response to failure of the comparison to generate the inhibit signal (54). A franking machine as claimed in claim 6, 7 or 8 further characterised in that one of the first and second connecting lines (26) comprises the connection carrying print data signals to the printing unit (20); and including switch means (45) located in the printing unit (20) interconnecting the first and second lines (26, 27) by a low resistance connection and wherein during a franking operation the switch means (45) is controlled to have a high resistance and the generator means (56) is rendered inoperative. A franking machine as claimed in claim 9 further characterised in that in a franking operation one of the first and second connecting lines (26) carries print data signals and the other connecting line (27) carries clock signals to control entry and read out of signals to and from the memory (25). A franking machine as claimed in any one of claims 1 to 5 further characterised by the provision of first generator means (56) in said secure housing (11) operative to generate a first pseudo-random signal; a second generator means (49) in said printing device (20) operative to generate a second pseudo-random signal corresponding to said first signal; means generating a synchronising signal to control the first generator means; a first connecting line (27) carrying said synchronising signal between the secure housing (11) and the printing unit (20) to synchronise the first and second generator means (44, 49); a second connecting line (26) carrying the second pseudo-random signal from the printing unit (20) to the interior of said secure housing (11); detector means (57) in said secure housing connected to said second connecting line and operative in response to a difference between signals on the second line and the first pseudo-random signal to generate an inhibit signal effective to inhibit operation of the franking meter. A franking machine as claimed in any preceding claim further characterised by the provision, externally of the secure housing, of a microprocessor (15); a keyboard (16) and display device (18) controlled by said microprocessor (15); and a data bus (19) interconnecting the microprocessor (15) and the accounting circuit (12).

Inventors: GILHAM DENNIS THOMAS, HERBERT RAYMOND JOHN, GILHAM, DENNIS THOMAS, HERBERT, RAYMOND JOHN
Applicants: NEOPOST LTD, NEOPOST LIMITED
Application year: 1990
Main classification: G07B17
IPC codes: G07B17