Digital postage meter system having a replaceable printing unit with system software upgrade

Abstract: A postage meter mailing system utilizes a meter vault (24) operated under the control of a microcontroller (44) mounted in a secure housing. The microcontroller (44) of the meter vault (24) has a communication device (43) for receiving and transmitting data messages and non-volatile memory (40, 41) for storing program data and other data. A printer (27) is utilized for printing a postage indicia. The printer (27) operates under the control of a microcontroller (66) mounted in a secure housing. The microcontroller (66) of the printer (27) has a communication device (63) for receiving and transmitting data messages and non-volatile memory (61, 62) for storing program data and other data. An interface (23) provides a communication path between the meter vault and the printer. The non-volatile memory (40, 41) of the meter vault has stored therein a program version number for identifying the control program version. The non-volatile memory (61, 62) of the printer has stored therein a software update number for identifying associated meter vault programs which utilize the update software. Upon system start-up, the print head microcontroller (60) requests the meter vault microcontroller (44) to transmit the control program version and number and determines whether the control program requires the update software and if so transmits the update software.

Description: The present invention relates to a postage metering system that utilizes a digital printer and, more particularly, to a postage metering system which includes a meter vault and a replaceable digital printing unit which are physically separated. Generally, a postage metering system includes a meter vault which accounts for the postage printed by a printing unit. The meter vault is comprised of a programmable microcontroller having a program memory for storing the system control program data. In an attempt to employ digital printers, such as ink-jet, in postage metering systems, it has been found that a print module configuration which includes the print heads, drivers and graphic imaging system within a single secure package is desirable. An electronic communication channel is provided between the meter vault and the print module to allow the communication of critical accounting and other data between the meter vault and the print module. This channel may also be used to allow communication between the print module and a mailing machine. It is conventional practice to provide system software updates from time to time which either correct software defects, increase system efficiencies or add system functionality. Submitting the meter vault to system software updates or modifications has typically been accomplished in one of three ways. Under certain circumstances the meter vault must be taken out of service and returned to the manufacturer where the security housing is removed and special equipment is used to load updated software into the program memories of the system. If sufficient unallocated program memory exists, it may be possible to connect a special service device to a communication port of the meter vault and down load the updated software into the program memory or other usable non-volatile memory. The service device must be specially equipped to preserve the security of the meter vault housing and internal circuit security of the meter vault. Another way is to trade out the existing meter vault with a new meter vault. All of these processes represent substantial time and cost consequences. US Patent No. 4,813,912, issued on 21 March, 1989, discloses a system for securing a device, such as a printer assembly for use in a postal mailing system, from invasive and non-invasive tampering. The system includes a host, which may be a mailing machine associated with a printer, and a meter vault. Both the host and the vault contain a microcontroller for inter-communication purposes. US Patent No. 5,075,841, issued on 24 December, 1991, concerns a printer which is controlled by a CPU in which a ROM, which stores a control program executed by the CPU, can be replaced. The ROM holds both initializing data and associated identifying codes and these are transferred into corresponding locations in a non-volatile memory when the identifying codes of the ROM and non-volatile memory are inconsistent with each other. This comparison of the identifying codes takes place at each switch-on of power to the printer. It is an objective of the present invention to provide a convenient means of up-dating the control program data for the meter vault and the mailing machine which alleviates the time and cost consequences of the conventional processes. According to a first aspect of the invention, there is provided an improved postage meter mailing system, having: a meter vault including a microcontroller, said microcontroller of said meter vault having a communication means for receiving and transmitting data messages, a memory for storing program data and a printer including a microcontroller, said microcontroller of said printer having a communication means for receiving and transmitting data messages and a memory storage means for storing program data; characterized by: interface means for providing a communication path between said meter vault and said printer; said memory of said meter vault having stored therein data representing a numeric version of said program data; said memory of said printer having stored therein program update data and a data representing an associated numeric version for identifying associated program data; and said printer microcontroller having means for requesting said meter vault microcontroller to transmit said data representing said numeric version of said program data and for comparing said data representing said numeric version with said data representing said associated numeric version, wherein said printer microcontroller is operable to transmit said update data to said meter vault to replace said program data only if said numeric version is less than said associated numeric version. According to a second aspect of the invention, there is provided a method of updating program software of a postage meter system having: a meter vault including a microcontroller, said microcontroller of said meter vault having a communication means for receiving and transmitting data messages and a memory for storing program data; a printer including a microcontroller, said microcontroller of said printer having a communication means for receiving and transmitting data messages and a memory for storing program data; and interface means for providing a communication path between said meter vault and said printer; said method comprising the steps of: storing numeric data in said memory of said meter vault representative of said program data version; storing program update data in said memory of said printer; storing associated numeric data in said memory of said printer representative said program data version associated with said program update data; comparing said associated numeric data in said printer memory with said numeric data in said meter vault memory; and transmitting said update data to said meter vault, only if said associated numeric data is greater than said numeric data. According to a third aspect of the invention, there is provided an improved postage metering system of the type having a meter vault, the meter vault including a memory for storing a meter vault software program having a version number, and a printer in communication with said meter vault, characterized by the printer having: means for detecting the version number of the meter vault software program; means for comparing the detected version number with the version number of program update data stored in the printer; and means for transmitting a new meter vault software program from the printer to the meter vault to replace the meter vault software if the detected version number is earlier in sequence than the version number of program update data stored in the printer. In the accompanying drawings: Fig. 1 is a schematic of a postage metering system in accordance with one embodiment of the present invention; Fig. 2 is a schematic illustration of a communication path between the meter vault, mailing machine and print head units and of the respective control systems in accordance with an embodiment of the present invention; Fig. 3 is a process diagram of the start-up process of the postage meter system in accordance with an embodiment of the present invention; Fig. 4 is a process diagram of the slogan selection process of the postage meter system in accordance with an embodiment of the present invention; and Fig. 5 is a process diagram for mail processing of the postage meter system in accordance with an embodiment of the present invention. A postage meter system to be described below includes a base unit, more commonly referred to as a mailing machine, which serves as a platform for the meter unit. The base includes a microcontroller system which is responsible for controlling the transportation of envelopes in a sequential manner to a printing location whereat the printing unit can print a postage indicia and any other additional information, such as, an ad slogan, delivery address or bar code on the envelope. In a preferred configuration, it is contemplated that printing will occur during relative motion between the envelope and the printing unit associated with the meter. Therefore, the microcontroller system in the base will be responsible for relatively precise control of the motion of the envelope through the printing location. The metering is provided by way of two independent units which are a vault and a printer. The vault accounts for and dispenses funds for postal payment. Communication between the mailing machine, vault and printer is facilitated through a printer interface unit. The meter vault communicates with the print head to transfer encrypted messages for postage amount, piece count, and digital tokens. A digital token represents an alphanumeric sequence generated by using any suitable algorithm which uniquely identifies the postage indicia as originating from a particular postage meter system and verifying that that postage meter system is authorized for use by the Postal Authorities. Meter vault communications are routed to the print head through the printer interface. The meter vault securely communicates with the print head using any suitable digital encryption technique. The printer interface serves as a junction board for the mailing machine, meter vault, slogan box, and print head. This minimizes the number of connection points in the system. The printer interface provides the connections for a serial communication linkage and unregulated DC power from the mailing machine to the meter vault, transfers print command and status signals between the mailing machine and print head, interfaces the slogan box to the print head, supports a unique serial link between the meter vault and print head, and regulates logic and print nozzle power from the mailing machine to the print head. The slogan box stores graphics images representing the fixed part of the standard indicia (e.g., the eagle printed on US mail), low-value indicia, permit mail indicia, town circle (where appropriate), inscriptions, and customer slogans. It also stores the fonts for printing the variable data on the mail piece. All of the graphics data is either encrypted or signed, that is, subject to other types of encoding algorithms in the slogan box non-volatile memory. The encryption or signing is done at the manufacturers' facility. Only the print head contains the necessary decryption key to properly interpret the data. The communication by the meter vault includes encrypted information. Only the meter vault and the print head know the proper keys to utilize the information. The keys are stored in an ASIC (Application Specific Integrated Circuit) on the print head to reduce the opportunity for fraud. The microcontroller on the print head controls the printing operation including loading of NVM (Non Volatile Memory), decoding of messages with assistance of a DES (Data Encryption Standard) engine on the print head ASIC, and initiating of printing. The microcontroller helps to reduce the complexity of the ASIC. The print head ASIC decodes the mail position for printer sequencing, provides the proper timing for driving the print nozzles, supports external ink supply monitoring, interfaces to the NVM; support external communications, and performs self-test functions. The print head NVM also stores inscription representations. The meter vault stores a table of enabled inscriptions. When the operator at the mailing machine wishes to select an inscription, the print head transfers a list of the available options to the meter vault. The vault screens for only the enabled inscriptions and sends the information to the mailing machine. The operator's response is forwarded from the meter vault to the print head. As part of the system start-up process, the print head issues a message to the meter vault which directs the meter vault microcontroller to receive updated program data, only if that updated program data version has not already been written to the non-volatile memory of the meter vault. The print head then encrypts the updated program data and transmits that encrypted data to the meter vault. The microcontroller of the meter vault then decrypts the updated program data and stores the data in the nonvolatile memory of the meter vault. The program update code is loaded into the print module after fabrication by the manufacture and prior to shipment. Referring to Fig. 1, a postage meter system, generally indicated as 11, includes a mailing machine base 12. The mailing machine base 12 is of any suitable conventional design and, in the preferred embodiment, includes a feeder section 13, singulator 14 and scale section 15 positioned serially along a mail flow path. Following the scale section 15 is a print station at location A which is followed by a stacker 17. Any suitably designed feeder section 13, singulator section 14, scale section 15 and stacker section 17 may be used. The operation of the respective sections 13, 14, 15, and 17 is under the control of a mailing machine controller 21. Power to the system is provided by a conventional power supply 19. It should be appreciated that the mailing machine controller 21, in the preferred embodiment, will control such additional functional systems as the operator keyboard and display, unsecured departmental accounting (not shown) and other conventional system functions. As depicted in Fig. 1, a programmable read only rates memory (PROM 22) is detachably mounted to the mailing machine controller 21 to provide rate information to the mailing machine controller in any suitable conventional manner. Also, housed in the mailing machine is a printer interface 23, slogan box 25, meter vault 24 and print head/controller 27, hereafter referred to as print head 27. The print head 27 is mounted to rails 30 and 31 by any suitable means to be positionable, by any convention means such as by a motor (not shown) between a first position "A" which is the print position, a second position "B" which is a tape print position, and a third position "C" which is a cleaning position. At position "C" the print head 27 is brought into contact with a nozzle cleaning system of any suitable design such that, for example, where ink jet print technology is utilized by the print head 27, the nozzles may by cleaned. The positioning of the print head 27 along the rails 30 and 31 is under the control of the mailing machine controller utilizing any suitable conventional control means. Also, the mailing machine 12 includes provision for allowing the external connection of an external interface unit (EIU 26) to the printer interface 23 by any conventional means. The EIU 26 provides additional microprocessing functionality to the system 11 utilizing any suitable method. Referring to Fig. 2, the meter vault 24 includes source accounting memory 40 and 41, program memory 42, ASIC 43, CPU controller 44, and keyboard/display 45. As more specifically described subsequently, the ASIC 43 provides two RS-232 communications ports 46 in any suitable conventional means for facilitating communications with the mailing machine 21. The communication port 46 is modified to include an extra pin for receiving DC power from the mailing machine. It should be appreciated that the keyboard and display 45 provides an operator or postal agent a means of recharging the accounting registers of the accounting memory 40 and 41 through the keyboard in any suitable conventional manner. The mailing machine controller 21 is comprised of a controller CPU 50, code ROM 51, code RAM 52, user input/output 53, motor controller 54, and sensor controller 55. Also provided is a scale interface 56 and UART interface 57. The UART interface 57 is of any conventional design for allowing asynchronous serial communication. Of principle concern to the preferred embodiment of the present invention is that the UART interface facilitates communication between the mailing machine controller 21 and the other system units 23, 24, 25, 26 and 27. The print head 27 is comprised of a CPU controller 60, nonvolatile memory units 61 and 62, ASIC 63 and print units 64, 65, 66. In the preferred embodiment it is contemplated to use multiple ink jet printing units. Meter vault 24 communications to the print head 27 are routed through the printer interface 23 along communication path P47. The meter vault 24 securely communicates with the print head 27 using DES encryption. A number of encryption keys are preloaded into the ASIC 63 of the print head 27 and ASIC 43 of the meter vault 24. This will make discovering the keys impossible without reverse engineering of the ASIC 43 or 63. Communications path 47 is also used to select inscriptions and slogans in conjunction with the slogan box 25. A printer interface path P46 is provided for electrical communication with the EIU 26. As aforenoted, the EIU 26 represents an external unit which can be attached to the meter vault 24 to provide enhanced capability to the meter vault 24 when the meter vault 13 is used in combination with the featured mailing machine. The printer interface 23 serves as a junction board for the mailing machine 21, meter vault 24, print head 27 and a slogan box 25. By providing specific communication paths P13, P14, P17, P37, P46, P47 and P57 within the printer interface 23, the individual subsystems can be isolated in such a manner to remove the necessity for interdependent security measures. The slogan box 25 stores graphics images representing the fixed part of the standard indicia (e.g., the eagle printed on US mail), low-value indicia, permit mail indicia, town circle (where appropriate), inscriptions, and slogans. It also stores the fonts for printing the variable data on the mail piece. All of the graphics data is either encrypted or signed in the slogan box 25 non-volatile memory (not shown). Only the print head 27 contains the necessary decryption key to properly interpret the data. Because of the different indicia formats, each country will have its own indicia graphics, therefore its own slogan box 25 product code number. When a new print head 27 is positioned in the mailing machine 17, the controller 21 checks the local NVM 61 and 62; if it is un-initialized, the controller reads the slogan box 25 to retrieve the necessary graphics information. The print head 27 decrypts or verifies this data and programs it into its NVM 61 and 62. In the event that the print head NVM 61 and 62 are smaller than the slogan box NVM, only the subset of graphics necessary for. a particular mail run is loaded into the print head NVM 61 and 62. If the NVM 61 and 62 should become corrupted, e.g., fail a checksum test, the controller 60 can request a new memory download as though it were newly installed. When the mailing machine microcontroller 21 initiates the meter ad selection option as a result of operator selection via the user 1/0 53, the slogan box 25 will transfer a text description of each of its slogans to the mailing machine microcontroller 21 through the print head 27 and meter vault 24. Once the operator responds with the selected slogan to print by selection of the appropriate operator key on the mailing machine 11, the slogan box 25 transfers the bit-map slogan image to the print head 27 if it is not already loaded in the print head NVM 61 and 62. The slogan box 25 electrically connects to the print head 27. The print head 27 prints the indicia including postage amount, digital tokens, piece count, and date as well as an optional inscription and slogan on each mail piece. The fixed part of the image, fonts for the variable parts of the image, and inscription bit-maps are programmed into the print head's NVM 61 and 62 when the print head is first installed in the mailing machine 17. The meter vault 24 will send a message to the print head 27 indicating the format of the town circle. The print head 27 obtains the town circle information as either a text string from the meter vault 24 or a bit map from the slogan box and programs its NVM with the data. For each mail piece, the meter vault 24 transfers the variable indicia information such as the postage amount, digital tokens, meter serial number, and piece count to the print head 27. The print head controller 60 programs registers (not shown) in the ASIC 63 with this information. When the mailing machine microcontroller 21 commands the print head 27 to print, the ASIC 63 combines the fixed and variable parts of the image for printing by the print units 64, 65 and 66 utilizing any suitable technique. The interface with the meter vault 24 includes encrypted information; only the meter vault 24 and the print head 27 know the proper keys to utilize the information. The keys are stored in an ASIC 63 on the print head 27 and the meter vault ASIC 43. The controller 60 on the print head 27 controls the printing operation including loading of NVM 61 and 62, decoding of messages and initiating of printing. The print head ASIC 63 also decodes the mail position for printer sequencing, provides the proper timing for driving the print nozzles, supports external ink supply monitoring, interfaces to the NVM 61 and 62; supports external communications, and performs self-test functions. The print head NVM 61 and 62 also stores inscription representations. The meter vault 24 stores a table of enabled inscriptions when the operator at the mailing machine 11 wishes to select an inscription, the print head 27 transfers a list of the available options to the meter vault 24. The vault 24 screens for only the enabled inscriptions and sends the information to the mailing machine microcontroller 21. The operator response is forwarded from the meter vault 24 to the print head 27. Referring also to Figs. 3, 4 and 5, it is observed that the meter vault 24 may have any suitable known independent housing and internal security measures as well as the print head 27 may like-wise have independent housing and any suitable internal security since critical communication between the mailing machine controller 21, meter vault 24 and print head 27 are secure communications. Particularly, referring to Figs. 3, 4 and 5, during the system start-up process, the print head 27 generates a random number which is then encrypted by the ASIC 63. The random number is transmitted via path P47 in the encrypted and clear form to the meter vault 24. The meter vault 24 decrypts the random number and compares with the clear text. If a match is determined, then the meter vault 24 generates a message of critical data including the random number. The meter vault message is encrypted and transmitted along path P47 to the print head 27. The message is then decrypted and, if the random number transmitted matches the generated random number, the encrypted information is stored in NVM 61 and 62 for use in subsequent printing. The print head 27 then transmits a request to the meter vault 24 along path P47 to send the program software version number. In response, the meter vault 24 sends the software version number along path P47 which is received by the print head 27 and compared to a software version number stored in the nonvolatile memory 61 or 62 of the print head 27. The first time this comparison is made, a transfer bit is set in the printer memory. This transfer bit is first checked during subsequent start-ups and the update process aborted if the bit is set. If the version number transmitted to the print head 27 is equal to or greater than the version number stored in the non-volatile memory 61 or 62 of the print head 27 then the system is ready for normal operation. If the version number transmitted to the print head 27 is less than the version number stored in the non-volatile memory 61 or 62 then the print head 27 transmits the updated program data to the meter vault 24 which stores the updated program data in its non-volatile memory 40 or 41. The system is now ready for normal operation. Particularly referring to Fig. 4, in the manner described above, an operator may submit a query to the slogan box 25 for available slogans via paths P14 and P47. The slogan box 25 transmits the slogan descriptor information via path 47 to the meter vault 24 which masks the unusable postal inscriptions. The meter vault 24 then relays the modified message to the mailing machine controller 21 for presentation to the requester. The requester then makes a selection which the mailing machine controller 21 transmits via path P17, P57 to the slogan box 25. The slogan box 25 then transmits the data for the graphic image via path P57 to the print head 27 which stores the graphic information in the memories 61 and 62. The print head 27 then transmits via path P17 the information received to the mailing machine controller 21. Referring now to Fig. 5, to process mail items, a postage value is either operator selected or determined based upon data from the scale 15 via the scale interface 56. The mailing machine controller 21 transmits the appropriate postage value to the meter vault 24 via path P14 which then accounts for the postage value. The meter vault 24 then encrypts the critical accounting data and transmits the encrypted data via path P47 to the print head 27 where the data is decrypted. Once the data is successfully decrypted, the print head 27 transmits an OK to print message to the mailing machine controller 21 via path Pl 7. Upon receipt of the OK message from the print head 27, mailing machine controller 21 then transmits along path P17 a print enable and printing is commenced. It should now be appreciated that the afore described system provides the benefit of improving system security and provides a method of generating secure communications between system units.

Claims: An improved postage meter mailing system, having: a meter vault (24) including a microcontroller (44), said microcontroller of said meter vault (24) having a communication means (43) for receiving and transmitting data messages, a memory (40,41) for storing program data and a printer (27) including a microcontroller (60), said microcontroller of said printer having a communication means (63) for receiving and transmitting data messages and a memory storage means (61,62) for storing program data; characterized by : interface means (23) for providing a communication path between said meter vault (24) and said printer (27); said memory (40,41) of said meter vault (24) having stored therein data representing a numeric version of said program data; said memory (61,62) of said printer (27) having stored therein program update data and a data representing an associated numeric version for identifying associated program data; and said printer microcontroller (60) having means for requesting said meter vault microcontroller (44) to transmit said data representing said numeric version of said program data and for comparing said data representing said numeric version with said data representing said associated numeric version, wherein said printer microcontroller (60) is operable to transmit said update data to said meter vault (24) to replace said program data only if said numeric version is less than said associated numeric version. The improved postage meter mailing system of Claim 1, wherein said printer microcontroller (60) is operable to request said meter vault microcontroller (44) to transmit said data representing said numeric version of said program data, to compare said data representing said numeric version with said data representing said associated numeric version, and, only if said numeric version is less than said associated numeric version, to transmit said update data to said meter vault (24) during each start-up routine for the postage meter mailing system. The improved postage meter mailing system of Claim 2, wherein: said microcontroller (60) of said printer is operable to encrypt said update data prior to transmitting said update data to said meter vault (24); and said microcontroller (44) of said meter vault (24) is operable to decrypt said update data prior to said update data being stored in said memory of said meter vault. The improved postage meter system of Claim 3, wherein: said memory (61,62) of said printer has update data loaded after manufacture of said printer and prior to shipment. A method of updating program software of a postage meter system having: a meter vault (24) including a microcontroller (44), said microcontroller of said meter vault having a communication means (43) for receiving and transmitting data messages and a memory (40,41) for storing program data; a printer (27) including a microcontroller (60), said microcontroller of said printer having a communication means (63) for receiving and transmitting data messages and a memory (61,62) for storing program data; and interface means (23) for providing a communication path between said meter vault (24) and said printer (27); said method comprising the steps of: storing numeric data in said memory (40,41) of said meter vault (24) representative of said program data version; storing program update data in said memory (61,62) of said printer (27); storing associated numeric data in said memory (61,62) of said printer (27) representative said program data version associated with said program update data; comparing said associated numeric data in said printer memory (61,62) with said numeric data in said meter vault memory (40,41); and transmitting said update data to said meter vault (24), only if said associated numeric data is greater than said numeric data. A method of updating a program software as claimed in Claim 5, further comprising the step of setting a transfer bit in said printer memory the first time said comparison is made. A method of updating a program software as claimed in Claim 6, further comprising the step of first checking said transfer bit and if set aborting said method. The method of Claim 5, 6 or 7, further comprising the step of performing each of the steps previously recited during each start-up routine for the postage meter mailing system. The method of Claim 8, further comprising the steps of: encrypting said update data prior to transmitting said update data to said meter vault (24); and decrypting said update data prior to said update data being stored in said memory of said meter vault (24). The method of Claim 9, further comprising the step of storing said update data into said memory of said printer (27) after manufacture of said printer and prior to shipment. An improved postage metering system of the type having a meter vault (24), the meter vault including a memory (40,41) for storing a meter vault software program having a version number, and a printer (27) in communication with said meter vault (24), characterized by the printer having: means for detecting the version number of the meter vault software program; means for comparing the detected version number with the version number of program update data stored in the printer (27); and means for transmitting a new meter vault software program from the printer (27) to the meter vault (24) to replace the meter vault software if the detected version number is earlier in sequence than the version number of program update data stored in the printer. The improved postage meter system of Claim 11, wherein the detecting means is operable to detect the version number of the meter vault software program during each start-up routine for the postage meter system. The improved postage meter system of Claim 12, wherein the printer (27) includes: a microcontroller (60) and a memory (61,62); and interface means (23) for providing communication between the meter vault (24) and the printer (27); wherein the new meter vault software program is located in the memory of the printer. The improved postage meter system of Claim 13, wherein: the microcontroller (60) of the printer is operable to encrypt the new meter vault software program prior to transmitting the new meter vault software program to the meter vault (24); and the meter vault includes a microcontroller (44) for decrypting the new meter vault software program prior to the new meter vault software program being stored in the memory (40,41) of the meter vault (24). The improved postage meter system of Claim 14, wherein: the memory (61,62) of the printer (27) has the new meter vault software program loaded after manufacture of the printer and prior to shipment.

Inventors: NACLERIO EDWARD J, NACLERIO, EDWARD J.
Applicants: PITNEY BOWES INC, PITNEY BOWES INC.
Application year: 1996
Main classification: G07B17
IPC codes: G06F9, G07B17