EP0516403A2

EP0516403A2 - Method of remote diagnostics for franking machines

Info

Publication number: EP0516403A2
Application number: EP92304809A
Authority: EP
Inventors: Cyrus Abumehdi
Original assignee: Neopost Ltd
Current assignee: Neopost Ltd
Priority date: 1991-05-29
Filing date: 1992-05-28
Publication date: 1992-12-02
Anticipated expiration: 2012-05-28
Also published as: EP0516403A3; GB9111490D0; DE69221538D1; GB2256396A; EP0516403B1; GB2256396B; DE69221538T2

Abstract

A franking machine system is disclosed in which each franking machine (10₁-10_n) includes a fault history memory (22) into which fault codes are written as each fault occurs. Periodically the accumulated fault codes in the memory (22) are read out and transmitted to a remote central fault analysis computer (24) to generate a prediction of faults likely to occur in each franking machine (10₁-10_n). Where the franking machines (10₁-10_n) periodically communicate with a remote re-setting computer (20) for re-setting credit in the franking machines (10₁-10_n), the re-setting computer (20) includes storage means (23) to store the fault histories from each of the franking machines (10₁-10_n) and each credit re-setting operation with a franking machine (10₁-10_n) includes transmission to the re-setting computer (20) and writing into the storage means (23) thereof of the fault history of that franking machine (10₁-10_n). The fault analysis computer (24) periodically communicates with the re-setting computer (20) to receive the fault histories stored therein of the franking machines (10₁-10_n).

Description

This invention relates to remotely diagnosing faults which may occur in franking machines.
Franking machines in use in the field may develop faults at indeterminate periods. Some faults may be insignificant and merely prevent use of certain facilities normally provided by the machine or may be intermittent and affect use of the franking machine at indeterminate times. Other more serious faults may occur which result in inhibition of use of the machine for franking of mail items. The latter more serious faults cause significant inconvenience to the user of the machine because the machine is not available for use in franking mail. It is desirable to reduce or prevent the occurrence of faults in machines in order to ensure that generally the machines are always available for use when required. By maintaining a fault history of each machine in the field it is possible from analysis of the fault history of any individual machine to predict and provide an early warning of the possible occurrence of a specific fault. From this predictive information action may be taken to service or modify the franking machine prior to the occurrence of the predicted fault and thereby prevent loss of use of the machine.
According to the invention a method of remotely diagnosing faults which may occur in a franking machine comprises the steps of storing in a memory of the franking machine a fault code identifying a fault in the franking machine upon occurrence of the fault to form a fault history of the franking machine; periodically accessing said memory to read said fault history comprising codes stored in said memory subsequent to a previous access; transmitting said fault history read from the memory to a central computer; and analysing said fault history to provide an indication of impending faults.
The invention also envisages apparatus for carrying out the method.
The method in accordance with the invention will now be described by way of example with reference to the drawings in which:-

Figure 1 is a block diagram illustrating franking machines connected for communication with a remote resetting centre and service centre, and
Figure 2 is a flow chart of a sequences of events in remote fault diagnosis and remedial action in respect of a franking machine.

Referring first to Figure 1, a franking machine 10₁ comprises an electronic microprocessor 11 for carrying out control and accounting functions in the franking machine. A keyboard 12 is provided for input of data by a user of the machine and a display device 13 is provided to enable the microprocessor to display information to assist the user in using the franking machine. A read-only memory (ROM) 14 is provided for the storage of fixed information such as program routines for controlling operation of the microprocessor 11 and a random access memory 15 is provided as a working store for the microprocessor. Non-volatile memories 16, 17 are provided for the storage of accounting data and as is well known in franking machines may include a descending register for storing a value of credit available for use in franking of mail items with postage value, a tote register for storing an accumulated value of postage used in franking mail items, an items register storing a count of the number of items franked and a high items register for storing a count of the number of items franked with a postage value in excess of a predetermined value. A printing device 18 is controlled by the microprocessor to print franking impressions on mail items. In franking machines which operate in a pre-payment mode, the user of the machine makes a payment to the postal authority and the value of the payment is entered into the descending register of the franking machine to provide an amount of credit available for use in franking mail items with postage value. The read-only memory 14 stores a program routine for controlling the microprocessor in carrying out franking operations. In such franking operations, the user of the machine inputs by means of the keyboard 12 a value of postage with which a mail item is to be franked and the microprocessor checks to determine that there is a sufficient value of credit in the descending register for required franking. If there is sufficient credit the microprocessor continues with the program routine to modify the contents of the registers to take account of the franking being effected and to operate the printing device to print a franking impression with the required postage value on the mail item. If there is insufficient credit available the franking routine is terminated and printing of the franking impression is not effected. The franking machine remains incapable of carrying out further franking operations until such time as additional credit has been entered into the descending register.
As is well known in franking machines those operational parts of the machine which maintain accounting records and which effect printing of the franking impression are protected from attempts to fraudulently interfere with the operation thereof. To this end the operational parts of the machine are housed in a secure housing access to which may be made only by authorised personnel of the postal authority or of an authorised service organisation and any external electrical connections to the machine are protected to prevent external application of unauthorised signals in an attempt to use the machine fraudulently. The accounting operations and storing of the accounting records are carried out in a manner to ensure integrity of the accounting data even in the event of the occurrence of faults in the machine. For example, each register is duplicated in each of the non-volatile memory devices 16, 17 so that if one device should fail, the registers in the other device will continue to store the accounting data.
The franking machine is provided with an input/output interface 19 communicating with the microprocessor to enable the microprocessor to communicate with apparatus external to the franking machine.
Previously, when the credit value in the descending register had fallen to a low value it was necessary for the postage meter of the franking machine to be taken to a resetting authority such as the postal authority to have an increased value of credit entered into the descending register. However current postage meters are constructed to have provision to enable increased credit to be entered remotely without removing the postage meter from the user's premises. A system for re-setting credit in a franking machine remotely by means of a re-crediting computer 20 is described in our european patent application 89313220.9. Communication is established between the microprocessor of the franking machine and a re-crediting authority computer 20 via the interface 19 and a telephone network 21. The microprocessor 11 and the computer 20 carry out a series of steps in which credit update information is transmitted from the computer to the franking machine and in which the franking machine sends accounting data from its registers to the computer. Security in transmission of the information over open telephone lines is maintained by transmitting a transaction identity code comprising a pseudo-random number in messages between the computer and franking machine and by encrypting the messages.
During operation of franking machines faults may occur which in themselves do not prevent operation of the machine for franking purposes but which may provide an indication that a more serious fault condition preventing use of the machine has a probability of occurring in the future. Accordingly it is desirable to log faults as they occur in each machine to provide a fault history for each individual franking machine and to analyse these faults to determine if from experience any of the machines in use in the field have a fault history which suggests that they are likely to fail in operation. The franking machine 10₁ is provided with a fault register 22 having a number "n" of storage locations. Upon occurrence of a fault, the microprocessor writes a code representing the type of fault which has occurred into a storage location of the fault register, the codes being written into the storage locations in turn. Thus at any time, the register stores a log of the most recent "n" faults which have occurred. The program routine carried out by the franking machine during re-setting of credit includes a sub-routine in which the contents of all the storage locations of the fault register 22 are read out and transmitted to the re-crediting authority computer 20. The storage locations of the fault register are erased so that after read out, the register is ready to receive the code representing the next fault when it occurs. Instead of erasing the storage locations of the fault register, the storage locations may be overwritten in turn in such a manner that when the code for each new fault is written to the register the code for the oldest fault is overwritten. Accordingly the codes stored in the register always represent the most recent "n" faults which have occurred. The re-crediting authority computer is provided with memory 23 and when the computer receives the log of fault codes from a franking machine in the course of re-setting credit in that franking machine, the computer writes the log of fault codes into its the memory 23. It will be appreciated that a large number of franking machines 10₁ - 10_n are re-credited as and when required by a single central re-crediting computer. Accordingly the log of fault codes is stored in the memory together with information identifying the meter from which the log has been received. Thus over a period of time, the computer 20 will receive and store in memory 23 the fault logs or histories of all those machines 10₁ - 10_n which have had credit updated during that period. It will be appreciated that this transmission of fault data occurs automatically each time a franking machine is re-credited and hence as result does not require communication with the franking machine specifically for the purpose of transmitting fault data. Accordingly the user of the machine is not required to carry out any additional operation and the accumulation and transmission of fault data is transparent to the user. Furthermore by transmitting the fault log data as part of the re-crediting routine, the data is transmitted and collected at the computer memory 23 at a periodicity which corresponds to some extent upon the amount of use of each franking machine. In Figure 1, the fault register 22 is shown as a separate element however if desired the fault register may be implemented as a register in the non-volatile memories 16, 17 and like the accounting registers in these memories may be duplicated in each of the memories 16 and 17.
Servicing and correcting faults in franking machines is carried out by an authorised service organisation. The service organisation is provided with a computer 24 which is capable of communicating with the re-crediting authority computer 20 and is permitted to have access to the fault log data in memory 23. Periodically the computer 24 accesses the fault log in memory 23 and an analysis of the faults which have occurred on the franking machines is carried out. Such an analysis may predict that a specific franking machine is likely to develop a specific fault and in accordance with that prediction a service engineer visits the site of the franking machine to carry out modification or repair of the machine to prevent occurrence of the predicted fault. The analysis alternatively may predict that a specific batch of machines is prone to one or more specific faults in which event action may be taken to modify all machines in that batch to prevent occurrence of that fault in those machines of the batch which are not yet affected.
Where the re-crediting of franking machines is carried out by means of transportable memory modules as in the CREDIPAC re-crediting system marketed by Alcatel Business Systems Limited, the transportable modules may be utilised to convey fault log data from the franking machine to the computer 20 instead of utilising the telephone network. For a more detailed description of the operation of re-crediting utilising a transportable memory module reference may be made to the specification of our British patent No. 2173738.
As hereinbefore described, transmission of the fault log data from the franking machine is effected each time the franking machine is re-credited. However transmission of the fault log data may be effected as part of another routine which occurs periodically for each machine. For example, franking machines which are operated in a post payment mode do not carry out re-crediting operations. However periodically the postal authority require to receive data relating to usage of the machines and for this purpose receive the values stored in the accounting data registers to enable the authority to audit usage of the machines. Where the data relating to usage of the machines collected remotely by transmission of the data either by means of the telephone network or for example by means of a transportable module the transmission of fault log data may be effected as a sub-routine of the main routine for collection of account data.
The flow chart of Figure 2 illustrates the steps carried out in each of the franking machines 10₁ - 10_n, the central re-crediting computer 20 and the service computer 24 to provide fault histories of each machine, to transmit these fault histories to the service computer and to modify or repair the machines in dependence upon analysis of the fault histories.
Analysis of the fault log of a specific franking machine may indicate that there is a probability of failure of a component of that machine which would result in the machine becoming inoperable to effect franking of mail items and hence require an on-site visit by a service engineer to effect an early repair or replacement of that component to ensure that the machine continues to operate satisfactorily and remains in service. However the analysis of the fault log may indicate a fault history which does not require physical replacement or repair of a component. For example faults may arise from software program routines or sub-routines particularly under certain conditions of use of the machine in which there is interaction between sub-routines which had not been envisaged when the software was written or installed in the machine. Such faults may also arise due to change in tolerances of electronic components such that they are required by a software routine to operate close to a current tolerance limit. A modification of the software routine may be made which has the effect of operating the component safely within its current tolerance. In response to such faults being registered in any of the franking machines, transmitted to the re-credit computer 20, and written to the memory 23 and then being transferred to the service computer for analysis, the software may be modified to overcome any tendency for the detected fault to occur. Instead of installing the modified software by on-site visits of a service engineer, the service computer 24 may communicate via the telephone network 21 with a selected one of the franking machines 10₁ - 10_n to enable the modified software code to be transmitted to the franking machines from the service computer via the telephone network. The modified software code may be transmitted to all franking machines of a specified model number in the field or only to those franking machines which, from analysis of their fault histories, indicate a need for modification of the software. Access to the memories in the franking machines which store software code must be restricted to prevent unauthorised modification of the software and accordingly any transmission from the service computer to the franking machines for the purpose of modifying or writing new software routines into the memories of the franking machines includes signals which enable access to the software code memories to be obtained. Such transmissions are carried out in a secure manner to ensure that only authorised transmissions enable access to the software code memories and that only the software code transmitted in an authorised transmission is written to the memories of the franking machines. A method of securely transmitting data over a telephone network for the purpose of re-crediting a franking machine is described in our European patent application 89313220.9 referred to hereinbefore. A similar secure method of transmitting data may be used for transmission of signals to modify operation of the franking machine. Where re-crediting is effected by means of a transportable memory module as described in our British patent No. 2173738 and referred to hereinbefore modification of software code in a franking machine may be effected by utilising the transportable memory module to carry the modified software code to be written into the memory of the franking machine. Our British patent describes a method of ensuring security of the data carried by the module and such a method may be utilised to ensure security of signals carried by the module to be utilised to modify operation of the franking machine.
The modification of software may include re-configuration of variables capable of being set in the franking machine software program routine. The software memories of the franking machine may be loaded with a number of subroutines in manufacture of the franking machine. Some of these sub-routines may be activated upon installation of the franking machine while others of these sub-routines are left in-activated. During use of the franking machine in the field it may be desired to de-activate or activate selected ones of these co-resident sub-routines either to modify the facilities provided by the franking machine or in order to overcome the probability of a fault arising as indicated by the analysis of the fault history of that machine.
When faults occur in the franking machine, fault flags are set to indicate the occurrence of the fault. Some faults may arise due to a detected error in data stored in the franking machine. Electronic accounting data is handled by the circuits of the franking machine in a manner such that, except in the event of catastrophic failure, the data can be re-constructed. For example each register which stores accounting data is replicated four times and in each operation of the franking machine involving the accounting data the contents of the four replications of the registers are compared. If the contents are identical continued operation of the franking machine is permitted. However if the contents of three replications of the register are the same but one register is different a fault flag is set to inhibit continued operation of the machine. Since the contents of three replications of the register are identical it is clear that these replications contain correct data. Accordingly a sub-routine can be activated to correct the data in that one of the replications which is different from the other three replications and to reset the fault flag. This subroutine may be activated remotely by the service computer using a secure transmission and then the fault flag may be reset remotely by a secure transmission. If the data has been corrected the fault flag can be reset. Other faults may occur which do not involve electronic data. If the fault is transitory or intermittent a transmission to reset the fault flag will be successful in resetting the fault flag. However where a permanent or non-transitory fault exists the reset of the fault flag will fail. Many faults are transitory or intermittent and hence the remote resetting of the fault flag allows the franking machine to be continued to be used until a service repair can be effected.
In Figure 1, the service computer 24 is shown as communicating with the re-credit computer by means of a dedicated communication link 25. However it is to be understood that the service computer may communicate with the re-credit computer via the telephone network 21.

Claims

A method of remotely diagnosing faults which may occur in a franking machine characterised by the steps of storing in a memory (22) of the franking machine (10₁) a fault code identifying a fault in the franking machine upon occurrence of the fault to form a fault history of the franking machine; periodically accessing said memory to read said fault history comprising codes stored in said memory subsequent to a previous access; transmitting said fault history read from the memory (22) to a central computer (24); and analysing said fault history to provide an indication of impending faults.
A method of remotely diagnosing faults as claimed in claim 1 further characterised in that the franking machine (10₁) is in communication from time to time with a central re-crediting computer (20) for updating of credit stored in the franking machine and in that said memory (22) in the franking machine is accessed and the fault history stored therein is transmitted to the central re-crediting computer (20) each time the franking machine is in communication with the central re-crediting computer for re-setting of the credit stored in the franking machine.
A method as claimed in claim 2 further characterised by the step of storing at the central re-crediting computer (20) the fault history received from each of a plurality of franking machines (10₁-10_n) as the respective franking machines are re-credited by the re-crediting computer (20).
A method as claimed in claim 3 including the step of periodically accessing the fault histories stored by the central re-crediting computer (20) and transmitting said fault histories to a fault analysis computer (24).
A method as claimed in any preceding claim further characterised in that the fault history is transmitted from the franking machine (10₁-10_n) to the central computer (24) via an input/output interface (19) of the franking machine and a telephone network (21).
A method as claimed in any one of claims 1 to 4 further characterised in that the fault history is transmitted from the franking machine to the central computer (24) by writing said fault history into a transportable memory module; connecting said module to the central computer (20) and reading the fault history from the module to the computer.
A method as claimed in any preceding claim further characterised by means (24) responsive to the fault history received by the central computer and operable to communicate with at least one selected franking machine (10₁-10_n) to effect modification of operation of that franking machine.
A method as claimed in claim 7 further characterised in that the means (24) responsive to the fault history is operable in response to the fault history to transmit a signal to the selected franking machine effective to modify a program routine or sub-routine in said franking machine.
A method as claimed in claim 8 further characterised in that the modification of the program routine comprises activating or de-activating program sub-routines which are co-resident in the selected franking machine.
A method as claimed in claim 7 or 8 wherein the means (24) responsive to the fault history is operable to transmit a reset signal to the selected franking machine effective to reset a fault flag in said franking machine.
A method as claimed in any one of claims 7 to 10 further characterised in that the transmission of signals to modify operation of a selected franking machine is effected in a secure manner.
A franking machine system characterised by a franking machine (10₁) including a fault history memory (22); means (11) operative upon occurrence of a fault in said franking machine to write into said memory (22) a fault code representing said fault to form in said memory a fault history comprising a series of fault codes representing respectively a series of occurred faults;
a central computer (24) remote from said franking machine; communication means (21) for transmitting data between said franking machine and said central computer;
means (11) operative periodically to read said fault history comprising the series of fault codes from said memory (22) and to transmit said fault history via said communication means (21) to said central computer (24); and
said central computer (24) being operative in response to said fault history to analyse said fault history and generate an indication of impending faults of said franking machine (10₁).
A franking machine system characterised by a central re-crediting computer (20) including fault storage means (23); a plurality of franking machines (10₁-10_n) ; each said franking machine including accounting registers (16, 17) for storing accounting data; a fault history memory (22); means (11) operative upon occurrence of a fault in said franking machine to write into said memory (22) a fault code representing the fault which has occurred so that the memory (22) stores a fault history comprising a series of faults codes representing a series of occurred faults; communication means (21) operable to transmit data between said central computer (20) and each of said franking machines;
means operable to exchange data between the central computer (20) and a selected one of said franking machines (10₁-10_n), said data including re-crediting data effective to re-credit said accounting registers (16, 17) of said selected franking machine and to read out from said fault history memory (22) of said selected franking machine said fault history stored therein and to transmit said fault history to said central computer (20) for storage in said fault storage means (23); and
a fault analysis computer (24) operable periodically to communicate with said re-setting computer (20) to read out fault histories stored in said fault storage means (23) relating to franking machines of said plurality and to analyse said fault histories and to generate for each franking machine an indication of impending faults.