Fault tolerant smart card

• US 4,908,502 A
• Filed: 02/08/1988
• Issued: 03/13/1990
• Est. Priority Date: 02/08/1988
• Status: Expired due to Term

• Current Assignee: Pitney Bowes Incorporated (Böwe Systec AG)
• Original Assignee: Pitney Bowes Incorporated (Böwe Systec AG)
• Inventors: Jackson, Winslow E.
• Primary Examiner(s): TRAFTON, DAVID
• Application Number:
  US07/153,391
• Time in Patent Office: 764 Days
• Field of Search: 235/492, 235/380, 235/437, 235/438
• US Class Current: 235/437
• CPC Class Codes: G06F 11/073 in a memory management context, e.g. virtual memory or cache management memory management G06F12/00; testing of static memory units G11C29/00
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/10 Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
• CPC Class Codes: G06F 11/1641 where the comparison is not performed by the redundant processing components
• CPC Class Codes: G06F 11/165 with continued operation after detection of the error
• CPC Class Codes: G06F 11/1654 where the output of only one of the redundant processing components can drive the attached hardware, e.g. memory or I/O
• CPC Class Codes: G06F 11/2236 to test CPU or processors
• CPC Class Codes: G06K 19/072 the record carrier comprising a plurality of integrated circuit chips
• CPC Class Codes: G06K 19/073 Special arrangements for circuits, e.g. for protecting identification code in memory protection against unauthorised use of computer memory G06F12/14
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G07B 17/0008 Communication details outside or between apparatus coin-freed apparatus for franking per se G07F17/26
• CPC Class Codes: G07B 17/00314 Communication within apparatus, personal computer [PC] system, or server, e.g. between printhead and central unit in a franking machine
• CPC Class Codes: G07B 2017/00177 from a portable device, e.g. a card or a PCMCIA
• CPC Class Codes: G07B 2017/00338 Error detection or handling
• CPC Class Codes: G07B 2017/00346 Power handling, e.g. power-down routine
• CPC Class Codes: G07B 2017/0079 Time-dependency
• CPC Class Codes: G07F 7/082 Features insuring the integrity of the data on or in the card
• CPC Class Codes: G07F 7/084 Additional components relating to data transfer and storing, e.g. error detection, self-diagnosis
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A fault tolerant smart card is provided having primary functional units including a standard ISO interface, a first microcontroller, a clock, and main memory. Secondary functional units including a secondary microcontroller, secondary memory with bit checking capability and an alternate battery power source are also provided. A microcontroller error detector is connected to both microcontrollers. Should a discrepancy between microcontrollers occur known test patterns are run on the second microcontroller to determine which microcontroller is faulty. A private access port provides alternate access to information stored in the fault tolerant smart card. Registers for funds remaining, error condition and access account are also provided.

Claims

1. A fault tolerant smart card comprising:

a standard input-output interface;

clock means for providing a time reference during smart card operations;

main memory means for storing program and data information;

first microcontroller means connected to said interface, said clock means and said main memory means for performing normal smart card functions;

secondary microcontroller means connected to said first microcontroller means, said clock means, said main memory means and to secondary memory means for performing normal smart card functions in synchronization with said first microcontroller means;

microcontroller error detection means connected to said first microcontroller means and said secondary microcontroller means for detecting a failure of either of said first or secondary microcontrollers; and

primary power supply means connected to said first microcontroller means.

2. The fault tolerant smart card according to claim 1 wherein said secondary microcontroller means has read-only access to said main memory means.

3. The fault tolerant smart card according to claim 1 wherein said clock means further comprise a primary clock and a secondary clock, said secondary clock being connected to a secondary battery power means.

4. The fault tolerant smart card according to claim 1 further comprising an access account register connected to and addressed by said first microcontroller means for providing a history trace of user identity and memory locations addressed by prior users.

5. The fault tolerant smart card according to claim 1 wherein said secondary memory further comprises read-only memory including programming for running one or more known test patterns on said second microcontroller.

6. The fault tolerant smart card according to claim 5 wherein said secondary memory programming is activated by said microcontroller error detection means upon detection of a failure in either of said first or second microcontroller means.

7. The fault tolerant smart card according to claim 6 wherein, upon indication of a microcontroller failure by said microcontroller error detection means, said first microcontroller is maintained in a frozen state while said secondary microcontroller runs said known test patterns.

8. The fault tolerant smart card according to claim 7 wherein, should an error occur in said known test patterns, said secondary microcontroller is assumed to be faulty and said first microcontroller is permitted to continue processing.

9. The fault tolerant smart card according to claim 7 wherein, should no error occur in said known test patterns, said first microcontroller is assumed to be faulty and card failure is indicated to the user.

10. The fault tolerant smart card according to claim 9 further comprising private access port means connected to said second microcontroller means for permitting service access to the fault tolerant smart card.

11. The fault tolerant smart card according to claim 10 further comprising a funds remaining register connected to said second microcontroller and further connected to and accessible through said private access port means for indicating a remaining amount of funds stored in the fault tolerant smart card.

12. The fault tolerant smart card according to claim 10 further comprising access account means connected to said first microcontroller means and connected to and accessible through said private access port means for providing a history trace of user identity memory locations addressed by prior users.

13. The fault tolerant smart card according to claim 11 wherein said secondary microcontroller, said secondary memory, and said funds remaining register are connected to a secondary battery power source.

14. The fault tolerant smart card according to claim 12 wherein said secondary microcontroller, said secondary memory and said access account means are connected to a secondary battery power source.

15. The fault tolerant smart card according to claim 10 further comprising checking bit means associated with said secondary memory for detecting and circumventing single bit or single path failures within said secondary memory.

16. The fault tolerant smart card according to claim 1 wherein said microcontroller error detection means further comprise an exclusive "OR" gate furnished with the output signal of each of said first and second microcontrollers, said exclusive "OR" gate being triggered to produce an error signal should a discrepancy occur between said microcontroller output signals.

17. A fault tolerant smart card comprising:

a standard input-output interface;

clock means for providing a time reference during smart card operations;

main memory means for storing program and data information;

first microcontroller means connected to said interface, said clock means and said main memory means for performing normal smart card functions;

secondary microcontroller means connected to said first microcontroller means, said clock means, said main memory means and to secondary memory means, said secondary microcontroller means performing normal smart card functions in synchronization with said first microcontroller means;

microcontroller error detection means connected to said first and secondary microcontroller means for detecting a discrepancy between said first and secondary microcontroller means; and

private access port means connected to said secondary microcontroller for providing private access to the fault tolerant smart card.

18. The fault tolerant smart card according to claim 17 wherein, upon detection of an error by said microcontroller error detection means, said first microcontroller is maintained in a frozen state and said secondary microcontroller is released from said main memory means to run known test patterns under the direction of said secondary memory means.

19. The fault tolerant smart card according to claim 18 wherein, should an error occur during said known test patterns, said secondary microcontroller will be assumed faulty and said first microcontroller will be permitted to continue processing.

20. The fault tolerant smart card according to claim 18 wherein, should no error occur during said known test patterns, said first microcontroller is assumed faulty and a faulty card signal is transmitted to the user.

21. The fault tolerant smart card according to claim 20 wherein said private access port permits access to information contained in said main memory means.

22. The fault tolerant smart card according to claim 21 further comprising a funds remaining register connected to said secondary microcontroller and said private access port means for storing information relating to available funds remaining within the fault tolerant smart card.