ELECTRONIC POSTAGE METER HAVING IMPROVED SECURITY AND FAULT TOLERANCE FEATURES

摘要

ELECTRONIC POSTAGE METER HAVING IMPROVED SECURITY AND FAULT TOLERANCE FEATURES A microcomputerized postage meter that provides high degrees of security and fault tolerance. The meter maintains data security under low power conditions by the use of functionally nonvolatile memory units. Register and other data which must survive normal and abnormal losses of power to the meter electronics are stored in dual redundant battery augmented memories (hereinafter designated BAMs). Upon detecting an error condition, the microcomputer writes an appropriate fault code to the BAMs. A mechanism for disabling the meter includes dual redundant flip-flops which are set to a "faulted" state upon detection by the microcomputer of a failure condition. These flip-flops are powered by the BAM batteries. They cannot be reset except by physical access to the meter interior, which access is only available to authorized personnel at the factory. The fault flip-flops are also set when the microcomputer fails to properly execute its own operating program. Once the meter has been set to a "faulted" state, the fault flip-flops hold two signals, MPCLR and SYSCLR, true. The BAM contents may still be read out independently of the microcomputer which is prevented from accessing the BAMs. This is accomplished by allowing power necessary to read the BAMs to be supplied to the BAMs without supplying power to the microcomputer. Moreover, even if the microcomputer is powered, MPCLR prevents it from executing instructions and SYSCLR isolates it. The various register values and the fault code then allow a reconstruction of the proper register values.