Franking Machine, With Printing Device External to Secure Housing

This invention relates to franking machines and in particular to such machines provided with franking printing means controlled by electronic accounting and control means to maintain an accounting record of data relating to franking impressions which have been printed.

Known franking machines utilise a mechanically operated print drum to print franking impressions. The print drum carries settable print wheels for printing the value of franking and the date of franking. The setting of the print wheels, and hence the value of the franking impression printed, is controlled by a franking meter which includes means for carrying out accounting functions in respect of usage of the meter in franking operations. Usually the meter includes a descending register which is reset to record a value of credit available for use in franking and in each franking operation this register is decremented by the value of franking impression printed. The accumulated value of franking used in franking operations is registered in an ascending register, this register being incremented in each franking operation by the value of franking printed Mechanical interlocks are provided to prevent fraudulent attempts to operate the printing mechanism independently of control by the meter and to prevent fraudulent attempts to reset the print wheels to print a franking value different from that registered by the meter.

With the availability of electronically operated printing devices such as thermal print heads and ink jet print heads, it is desirable to replace the mechanical drum print mechanism with electronically operated print device in order to provide greater flexibility in printing and to avoid the need for complex and expensive electro-mechanical interfaces between the electronic accounting and control circuits and the mechanical print elements of the drum printer. However such electronically operated printing devices could be operated by the external application of electrical signals to the print head elements or the drive circuits thereof and hence may be capable of being operated in a fraudulent manner. Accordingly measures must be taken to ensure security of the printing of franking impressions and the accounting thereof. One method of overcoming this problem is to house not only the meter circuits but also the printer, the drive circuits therefore and the interconnections between the meter and the printer in a secure housing. This has the disadvantage that, if a fault arises in the printer, repair of the fault requires access to the secure housing and as a result the postal authority may require the integrity of the accounting records maintained in the meter to be verified prior to re-use of the machine. It would be advantageous to place within the secure housing only those circuits concerned with performing functions for which there is a need for security and to house other elements of the franking machine externally of the secure housing thereby reducing the occasions when there is a need for access to the secure housing and to take measures to ensure that elements of the franking machine, such as the printer, housed externally of the secure housing cannot be operated in a manner to cause printing of a fraudulent franking.

According to one aspect of the invention a franking machine includes electronic accounting and control circuits operative to maintain a record of data relating to franking operations; a secure housing containing said accounting circuits; a printing device located externally of the secure housing for printing franking impressions on mail items; a connection from the accounting and control circuits in the secure housing to the printing device to carry a signal from the accounting and control circuits to the printing device; means to return said signal from the printing device to the accounting circuits; and detection means in the secure housing operative to compare the signal carried from the accounting and control circuits by the connection with the signal returned to the accounting and control circuits from the printing device; said detection means being operative to generate a signal effective to inhibit operation of the accounting and control circuits in response to failure of said comparison.

According to another aspect of the invention a franking machine includes electronic accounting circuits operative to maintain a record of data relating to franking operations; a secure housing containing said accounting circuits; a printing device located externally of the secure housing for printing franking impressions on mail items; a connection from the accounting circuit to the printing device to carry strings of print data signals from the accounting circuits to the printing device to control the printing device to print a franking of a selected value; means to return said strings of print data signals from the printing device to the accounting circuits; said accounting circuits including comparison means to compare each string of print data signals from the accounting circuit with a corresponding string of print data signals returned from the printing device; said accounting circuit being operative in response to a failure in said comparison to terminate printing of the franking impression.

An embodiment of the invention will now be described by way of example in which:

FIG. 1 is a block diagram of a franking machine,

FIG. 2 is a block diagram of a comparison circuit,

FIG. 3 is a modification of a part of the block diagram of FIG. 1, and

FIG. 4 shows a modification of the print head circuit.

Referring first to FIG. 1, a franking machine includes a franking meter 10 having accounting and control circuits housed in a secure housing 11. The accounting and control circuits include a microprocessor 12 and non-volatile memories 13, 14 for storing accounting data. Memory 13 includes descending and ascending registers for registering respectively the value of credit available for franking and the accumulated value of franking used. The memory also includes an items count register for registering the number of mail items franked and a high items count register for registering the number of mail items franked with a franking value exceeding a predetermined value. The aforementioned registers of memory 13 are duplicated so that the data is registered in duplicate. The memory 14 is similar to memory 13 and includes a further set of registers in duplicate thereby permitting the credit value, accumulated tote value, items count and high items count each to be stored in four different registers. This replication of registers ensures that the integrity of the stored data can be verified and in the event of corruption of data in any one of the registers the data can be restored from that stored in the corresponding registers.

The franking machine also includes, externally of the secure housing 11, a further microprocessor 15 for receiving input data entered by a user of the machine on a keyboard 16 or received via a communication interface 17. The microprocessor 15 controls a display device 18 to display data and information signals to the user of the machine. To enable communication between the microprocessors 12 and 15 a bus connection 19 is provided. A print head 20 operable to print franking impressions on mail items is connected to the circuits in the secure housing as will be described hereinafter. Feeding means 21 including a drive motor is provided to feed mail items one at a time past the print head to enable franking impressions to be printed thereon. The drive motor of the feeding means is energised under control of a control circuit 22 operated by the microprocessor 15.

The electronically operated print head 20 comprises a row of thermally operated print elements 23 which are heated by passage of electric current therethrough controlled by the data content of corresponding stages of a print buffer 24. For example, a binary `1` in a stage of the print buffer results in the corresponding print element being energised and heated whereas a binary `0` leaves the corresponding print element un-energised. A serial memory 25 receives print data serially via a print data input line 26 from the meter 10, the print data being clocked into the memory by clock pulses on line 27. The stages of the serial memory 25 correspond to and are connected by gates to the stages of the print buffer 24. When the serial memory is loaded with a string of print data, opening of the gates by a load print data control signal 28 causes the print data to be read from the serial memory and to be loaded in parallel to the stages of the print buffer 24 to set the stages thereof to correspond to the string of print data. A print strobe signal 29 applied to the print buffer causes the print elements 23 to be energised in dependence upon the binary value of the contents of the corresponding stages of the print buffer and hence selected print elements are heated to print dots along a line in positions determined by the print data. When print data corresponding to a line of printing is clocked into the serial memory 25, the previous content of the memory, corresponding to a previous line of printing is clocked out on a serial data output line 30. Thus as data corresponding to the dot pattern for one line is clocked into the serial memory, the data corresponding to the dot pattern for the previous line is clocked out on line 30.

The meter includes a check circuit 31 which receives the print data sent to the print head on line 26 and the data clocked out on line 30 from the serial memory 25 and carries out a comparison to test for identity between the print data sent, on line 26, and data returned on line 30. Due to the data string returned from the serial memory being delayed relative to the sending of that data string to the serial memory the check circuit 31 includes means to store the string of print data sent until the returned data string is received. This may be effected conveniently by providing duplicate sets of registers for storing the print data strings and the returned data strings and duplicate comparison circuits operated alternately to compare corresponding sent and returned data strings. The check circuit is shown in more detail in FIG. 2. The string of data corresponding to the dot pattern for a line transmitted to the print head on print data line 26 also is routed to one of a pair of registers 32, 33 of the check circuit 31 by gates 34, 35. The string of data read out serially from the serial memory 25 onto line 30 is routed by gates 36, 37 to one of a pair of registers 38, 39. The gates 34, 35 are operated to route the print data strings alternately to the registers 32, 33 and similarly the gates 36, 37 are operated to route the returned data strings alternately to the registers 38, 39 such that corresponding sent and returned strings are routed either to registers 32 and 38 or 33 and 39 respectively. Thus, for example print data strings representing the dot patterns of odd numbered lines are loaded into register 32 while print data strings representing the dot patterns of even numbered lines are loaded into register 33. A pair of comparators 40, 41 are operated aternately to compare the contents of the registers 32, 38 and registers 33, 39 respectively. If a returned data string corresponding to a sent print data string has identity with that sent print data string, the comparator 40 or 41 outputs a verification signal on line 42 to the microprocessor 12 to indicate that the print head received the correct print data string. On the other hand if the comparator does not find identity the verification signal is not output and the microprocessor terminates the printing of the franking operation and inhibits further use of the meter.

While the circuits described hereinbefore ensure the integrity of the print data strings received by the serial memory of the print head, it may be desirable to provide an additional security to these data strings. For this purpose, the meter 10 includes an encoding device 43 operative to add a security code 55 to the print data strings. The print data strings would each include the security code at a predetermined position within the string. To accommodate the resulting longer strings, the serial memory 25 is provided with additional stages 51 which are not connected to the print buffer register 24. The security code is varied in a random or non predictable manner. The code may remain unaltered for the duration of printing an individual franking impression or may change during the printing of a franking impression. The code may consist of a random group of binary digits or may be formed from a combination of a random number and all or part of the string of print data. If it is desired to print the security code on the mail items the print buffer is provided with additional stages 52 connected to those stages 51 of the serial memory in which the security code is stored and corresponding print elements 53 are provided as shown in FIG. 4. Instead of checking the entire data block i.e. the print data and the security code sent to the print head, the check may be carried out on only part of the data block. For example the check may be carried out in respect of the security code only. Accordingly the registers 32 and 33 would store the security code sent to the print head and the registers 38 and 39 would store the security code returned from the print head. Checking only a part of the data block would enable economies to be made in the size of the registers and comparator circuits. If desired the entire data block comprising the print data and security code may be returned from the serial memory 25 to the print data check circuit 31, the print data being discarded and the security code being entered into the registers of the check circuit 31. Alternatively the circuits in the print head may be arranged to return only the security code on line 30 to the check circuit 31.

Instead of checking the data blocks corresponding to each line, which as described hereinbefore requires the provision of two sets of registers and comparator circuits, checking may be carried out in respect of data blocks corresponding to alternate lines of print data. Accordingly this would require only a single set of registers and a single comparator circuit.

The security measures described hereinbefore are effective to ensure detection of fraudulent attempts to operate the print head by means of signals applied externally to the print head or drive circuits thereof while the print head remains connected to the meter. However it may be possible to disconnect the print head from the meter in which case the print head could be operated independently of the meter. Accordingly the meter may be provided with means to detect any attempt to disconnect. Even temporarily, the print head from the meter. The meter is provided with a connection check circuit 44 which includes a pulse train generator 56 to apply a pulse train to the print data line 26. The print head includes a transistor switch 45 connected between the print data line 26 and the clock line 27. This transistor switch is normally in a low resistance state so that the print data line and clock line are interconnected. As a result the pulse train from the check circuit 44 on the print data line is returned on the clock line 27. The check circuit 44 is connected to the clock line 27 to receive the returned pulse train and includes a comparison circuit 57 to compare the generated pulse train applied to the line 26 with the pulse train returned on clock line 27. If there is a match between the sent and received pulse trains the check circuit generates a signal on line 54 having a state indicating that the connection between the print head and meter is secure. However if at any time the comparison between the pulse trains fails, the state of the signal from the check circuit on line 54 changes to indicate that the connection has been broken and the signal remains in this state until the check circuit is reset by access to the secure housing. When the franking meter is in a franking mode of operation, prior to carrying out any franking the microprcessor 12 tests the state of the signal from the check circuit. If the signal on line 54 has a state indicating that the print head connection has been broken the microprocessor is inhibited from continuing the franking mode of operation. In its simplest form the check circuit may generate a uniform non-varying pulse train. However to prevent attempts to simulate the pulse train from an external source it is preferred that the check circuit generate a pulse train which varies in a non-uniform manner. It will be appreciated that the check circuit must remain operative even when the franking meter is switched off or disconnected from a mains electricity power source. Therefore the check circuit is permanently powered by a back up battery 46. This battery may be the same as that required to permanently power the non-volatile memories 13, 14. The interconnection of the print data and clock lines by the transistor switch 45 in its low resistance state prevents loading of print data into the serial memory. When a franking operation is to be performed the transistor 45 is switched to a high resistance state by a control signal on line 47. Thus any disconnection of the print head from the meter, except during the period of a franking operation will be detected by the check circuit 44. If desired the testing of the connections between the franking meter and the print head may also be carried out during franking operations, the tests being carried out in suitable intervals between sending print data to the print head. While this provides security against attempts to disconnect the print head at any time, sufficient security may be provided by holding the transistor switch at a high resistance state for the duration that the franking machine is powered and allowing the switch to revert to its normal low resistance state when the machine is not powered by the mains electricity supply thereby detecting disconnection of the print head when the machine is not powered.

A higher degree of security for the connections between the franking meter and the print head may be provided by the modified circuit shown in FIG. 3. The connection check circuit 44 is the same as that of FIG. 1 and this generates a pseudo-random waveform. A similar pseudo-random waveform generator 49 is provided on the print head 20. A master clock or synchronising signal is generated in the franking meter and this is utilised to clock the pseudo-random waveform generator 56 in circuit 44 and is transmitted by the line 27 to the generator 49 on the print head to clock generator 49. A system reset is generated every complete cycle of the pseudo-random pulse train to ensure that the pulse trains from circuit 56 and generator 49 are maintained synchronised. The pseudo-random pulse train from generator 49 is transmitted by line 26 to the comparison circuit 57 where it is compared with the pulse train generated by generator 56. It will be appreciated that the pulse train is transmitted on the line 26 which carries print data signals during franking operations in order to ensure that this line is not disconnected. Where required steering circuits are provided to steer signals along the required paths. The generator 49 on the print head is powered from the battery 46 by means of line 50. When it is desired to carry out a franking operation, the value of franking desired is entered on the keyboard and the microprocessor 15 passes this data to the microprocessor 12 in the secure housing and also causes the data to be displayed on the display device 18. The microprocessor 12 carries out a series of tests to check inter alia the state of the signal of the check circuit 44 and that the descending register is registering a credit value in excess of the value of desired franking. If all the tests are satisfactory, the microprocessor switches the transistor switch 45 to a high resistance state and outputs, one string at a time, strings of print data to the encoding device 43. A security code is added to the print data strings and the strings are transmitted to the print head and clocked into the serial memory for printing of lines of dots by the print elements. The mail item is fed by the feeding means 21 so that successive lines of printed dots build up a complete franking impression. Upon completion of the franking impression the mail item is ejected by the feeding means and the meter circuits return to a state to await the initiation of the next franking operation.

In order to prevent corruption of data in the circuits of the meter in the secure housing by the application of over-voltage signals, the bus connection 19 between the exterior of the housing and the microprocessor 12 within the housing is protected by suppression circuits 48 using transorbs. Generally there is no need to protect the connections between the meter module 10 and the print head 20, but if desired these also may be protected by suppression circuits.