Checking system, e.g. for passing toll stations.

The present invention relates to a type of control system in which a storing information in a portable object can be monitored by linking the object to a terminal that delivers or not authorized by the result of this control. It aims eg toll booths of equipment in which such an object carried by a person or a vehicle, for example, is presented to a control system that allows the passage if the stored information reflects the payment a sufficient amount and / or a suitable expiry date.

We know of access control systems which use cards provided with a magnetic strip memory, capable of being inserted into the slot of a terminal or access control device into which is read the information carried by the magnetic track. When this information is recognized suitable, an access authorization is issued at the same time new information is recorded on the magnetic track before the user removes it from the slot. This listing can be either identical to the previous or changed according to parameters that depend on the envisaged control type.

The access control systems magnetic card, however, are sometimes not very easy to use because of the narrowness of the slot where the card has to be inserted for an accurate reading of its contents by appropriate transducers. Thus, when the access control system is used on some equipment, such as for example the lifts in the winter sports resorts, handling card by users whose hands are not free, turns particularly slow and awkward.

Magnetic cards also have the disadvantage that the inscriptions they bear can be read by fraudsters relatively easily using the appropriate equipment for the unlawful reproduction of such recordings on a blank card.

In addition, the amount of information recorded on the magnetic tracks or is quickly limited by the physical dimensions of the or magnetic strips, quality of transducers and the proximity thereof with or magnetic strips.

Finally, playback components of these cards are expensive sometimes poorly adapted to harsh environmental conditions. They indeed require the presence of magnetic transducers and relatively expensive means of moving the card relative to the transducers or vice versa that make both complex and prone to failures, especially when they operate in some places protected against weather and temperature variations.

It has also been proposed a control device in which a token can be coupled with a terminal in order to ensure a transfer of data between the chip and a computer in the terminal. The chip includes a shift register memory element in which information can be read on every transaction by the terminal. After treatment with this, new information is written to the shift register memory.

According to one embodiment of such a system, the coupling between the token and the terminal is carried out by induction. To prevent the register can not be reinstated in fraud, a verification device is provided for comparing a valid control character of the card with an identification character permanently inscribed in the token. The coincidence of these two information allows you to enter new information in the token memory register coupled to the terminal. To avoid fraud is to try to determine the pre-registered identification character in the token by a large number of successive tests, a count of the number of failed registration attempts is made. When this number exceeds a predetermined threshold, the token may be invalidated.

However, the same identification character should be used in a very large number of chips. There is therefore a risk that over time the identification character of these chips will eventually be known, opening the door to fraud, which is to re-register a token using information corresponding for example to a higher number of payment units to the number of units for which the token was acquired.

The present invention aims to improve the security systems that implement control terminals and portable objects to electronic memory against unauthorized re-entry of data in the memory of those objects. It aims in particular to achieve such an object in an extremely simple manner so as to keep the cost at a very low level, while allowing the use for transactions requiring high security against fraud.

In one aspect, the invention thus relates to a portable object for a control system, and for example one of a process control system having a payment, of the type comprising an electronic circuit with at least one shift register to memory to store useful information, this information may include in particular an indication of a number of payment units. The object is equipped with a transceiver device for coupling it with a terminal equipped with a device of the same type so as to enable information exchange between them. Preferably, the transceiver system is the type contactless and clean to issue serial bit signals corresponding to the information read from the register and receive signals of the same type to reregister a new useful information in the registry. control means for recording of information in said object are provided, associated with a device for checking the consistency of this control information with a stored validity information in this item to authorize the re-registration of a useful information. According to the characteristic arrangement of the invention, this validity information is written into the shift register to memory at the same time as the useful information. Preferably it is renewed each reinstatement.

With the renewal of the validity information, each re-registration, it is very difficult for a fraudster to know this information in order to issue the corresponding direction control information object to authorize the re-registration. In addition, operating the verification of a match between the validity information and the control information within the object, avoids fraud consisting in triggering from playing a first object a signal re authorization which could be used for the re-enrollment of a second object that would have been substituted in the meantime the first object. Indeed, the terminal can not conduct this re when it receives the authorization of the object signal to re-register itself.

Preferably, information or code of validity of the portable object is transmitted to the terminal when playing his shift register memory. It is extracted from the set of information read by the terminal at the object to be sent to the control register thereof to permit cross-referencing.

According to an advantageous embodiment, it is anticipated that the validity of information is part of useful information. In this case, it is convenient to provide in advance a number of bits in scattered positions of the shift register constituting the validity information. The cells corresponding to these bit shift register are connected to the verification device. According to one embodiment, the connecting wiring between cells or shift register memory locations that contain information valid and respective inputs of the comparator device is scrambled. Thus, when the validity information is compared bit by bit in the control information, the bit order of succession of the latter is different from the validity information. The terminal allows for the interference to produce the control information.

According to one embodiment provides a particularly high degree of safety is provided to connect the verification device by a first connection to the shift register cells assigned to validity information and by a second connection to cells of the device listing the control information and is arranged on at least one of these links a coder for scrambling the correspondence between the bit order of comparison of the information and their transmission order series.

The invention further provides a an operation control system, including an operation comprising a payment, which includes a set of clean portable objects at each store useful information, and a terminal con trol which can be coupled each portable object to make a reading of the relevant information recorded in the latter and allow the registration of new useful information after processing the information read by the terminal. In this system, the control device is suitable for selecting, among the information transmitted during the reading of the memory of the portable object, validity of the information bits from which it generates a control information that can be sent to the portable object, verification of a match between the control information and validity information being required to authorize the re-registration of the memory of the portable object.

According to a preferred embodiment, the terminal comprises means adapted to reorder processing validity information extracted from the reading of the portable object to derive the control information according to a prescribed code.

The invention also provides other rules for implementing the control system which has just been mentioned.

According to one embodiment, the terminal is adapted to transmit continuously to the own polling messages to trigger in a portable object which is presented to a transmission procedure to that terminal information stored in the object. This information is converted to the terminal into electrical signals sent to a management unit.

It is desirable that at least one of the system components or emit only picks up signals transmitted within a narrow beam so that the signals exchanged between the terminal and the object presented to it are highly localized. This prevents them from disrupting the memory other portable objects, such as those neighbors already in a queue for a lift, for example, or can not be readily captured outside the terminal for their reproduction for fraudulent purposes.

Various types of signals may be used for the implementation of the invention. For example, it can emit light waves in the infrared using LEDs. One can also use small transmitters electromagnetic wave receivers microwave, or acoustic signal transducers that may advantageously function alternately in emission and reception.

Preferably a portable electronic object for a control system according to the invention comprises a source of energy for the autonomous supply of the circuits of the object.

Preferably also a terminal for a control system according to the invention comprises a signal transmitter housed at the bottom of a chamber of relatively small lateral dimensions, limited by the energy absorbing walls emitted and including an opening at an opposite end to the transmitter does allow for the release of energy emitted within a relatively narrow beam towards a portable object presented before the opening.

Before we can ageusement possible to equip the portable object of a bracelet that a user may attach to his wrist so as to enable easy presentation before the opening of the controlling terminal.

For winter sports resorts, for example, equipped with an access control system to the lifts, such an object can be advantageously provided to each skier at the beginning of the stay against bail and after payment of a sum of a fixed number of passes at toll points facilities and / or an expiration date, the number and / or the date being fixed in the memory at the time of delivery of the item to the skier.

The presentation to a control terminal of such a portable object is easy. There is indeed no need to introduce this portable object in a relatively small housing. When using acoustic waves for signal exchange, it is not necessary to extract it from a receptacle such as a bag of clothes and expose it to make contact with the terminal. It may indeed cooperate with it without direct contact and even through several layers of fabric or the like.

The portable object can be constituted in a simple manner, for example with acoustic transducers capable of operating in transmission and reception and which can be made inexpensively in a purely static form, with the current piezoelectric transducers.

The following description of embodiments is given by way of nonlimiting example with reference to the accompanying drawings, in which:<ul><li>1 shows a portable object according to the invention;</li><li>2 shows an access control terminal of a system according to the invention;</li><li>3 schematically shows an electronic circuit within the portable object of Figure 1;</li><li>4 schematically shows part of a circuit fitted to the device of Figure 2;</li><li>Figure 5 is a signal diagram of a type which can be implemented in the framework of the invention;</li><li>6 shows another embodiment of the circuit of Figure 4;</li><li>FIG 7 is a diagram of read and write signals of the device of Figure 6;</li><li>Figures 8 to 10 illustrate three memory variants shift register of its corresponding verification device associated in a circuit analogous to that of Figure 6.</li></ul>

A portable object 10 (Figure 1) comprises a plastic support 12 of generally rectangular shape and thin whose appearance is not unlike that of such watch case. This housing 12 is connected on two opposite sides to two strips 14 and 15 of a wristband allowing a user to attach the housing 12 around his wrist.

On the upper face of the housing 12 is formed a window 16 for the display, for example using liquid crystal, of information stored in memory in an electronic circuit embedded in the housing 12 and whose structure is explained with reference to Figure 3. in the central portion of the upper face of the housing is shown as a broken line 18, the trace of the active face of a piezoelectric crystal also embedded in the housing 12. a lid 20 to the upper surface of housing 12 allows access to a compartment for receiving a supply stack of integrated circuits C-MOS constituting the electronic part of the object 10.

On one of the side faces 22 of the housing 12 protrudes a button 24 for controlling the display in the window 16 the information stored in the object 10.

The piezoelectric crystal whose trace appears 18 is intended to emit acoustic waves in an ultra sound frequency selected for example within a range of 50 to 150 kHz, within a solid angle very small perpendicularly to the upper surface of the housing 12.

An access control terminal 11 (Figure 2) comprises a base 30 intended to be fixed to the ground of an access corridor.

From the base 30 depends on a bracket 32 ​​on top of which is mounted a box 34 of substantially rectangular shape and open on its front vertical face 36, which limits a chamber at the bottom of which is housed an acoustic transducer 40 (Figure 4) operating at the selected frequency mentioned above. This transducer low power but is very directive of the piezoelectric type. It is even more directive given by its position in the chamber bottom 34 and the shape and the inner lining of the enclosure. The enclosure walls absorb the waves that strike so that substantially only reach the opening 36 the signals in a low angular aperture beam. It is powered from electronic circuits housed in the base 30.

The control of the transducer circuit 40 (Figure 4) comprises an amplifier 42 connected to the terminals of crystal 40 and connected by a line 45 to a receiving circuit not shown in the base 30 and a transistor 44 whose base is controlled by a line 46 connected to a not shown transmission circuit, also housed in the seat 30, for controlling the emission of ultrasonic signals by the transducer 40.

of the opening 36 the dimensions of the front face of the top box 34 of the bracket 32 ​​are, for example, approximately 50 mm x 50 mm. The stem height is chosen to the size of a person of average height height, so it is easy for anyone with a portable object such as 10 to his wrist, to present the top of the housing 12 the front face 36 of the terminal housing 11. in this position, the acoustic transducers of the object 10 and the terminal 11 can exchange acoustic signals for an access control operation according to a procedure which will be described below.

The piezoelectric transducer of the portable object 10 is shown at 50 in Figure 3, in the schematic form of a loudspeaker. It is not necessary that it has similar directivity characteristics to the transducer 40. At the terminals of the crystal are mounted, on the one hand, a transmission circuit including a transistor 52 whose base is controlled by a line 53 at the output of an encoder 54 and, on the other hand, a receiving circuit comprising an amplifier 55 whose input 57 is connected to the crystal 50.

The piezoelectric crystal 50 is powered by a battery 51 housed in the compartment closed by the lid 20 which is intended to supply energy to all the active elements of the circuit of Figure 3.

A shift register integrated circuit is made in three parts shown separately for clarity of explanation: a shift register 60 which comprises between 60and 2000 cells (60 to 2000 bits corresponding to the information to be stored) connected in series with an input 62 and a serial output 64 connected both to the encoder 54 and secondly to the input 161 of a multiplexer 160; a shift register of said reading head 80 connected to the register 6₀; and another shift register said writing head 90 connected eh register 80 via link 91.

The information stored in the register 60 can be visualized by interméidiaire 68 parallel outputs of the register 70 connected to the inputs of the display device 16. The plots lines 71 are provided so as to correspond, in principle kept secret between the output bits of the register 60 and the display input bits 16. in other words, it is expected that information to the outputs 68 of the register 60, which may correspond to a quantity of information or a deadline of validity, is encoded such that, when bits 68 are transmitted to the 70 inputs of the display, the latter make appear a clear indication corresponding to content information stored in the register 70. the display is energized by a control line 73 through the push button 24.

The input 62 of the register 60 is connected to the output 81 of the register 80 which receives on its input the register series 84 series 92 of the output 90. The input 94 of the register 90 receives via the multiplexer 160 or the information from the register 60 (the latter then being looped back on itself by the line 65) is the information from the decoder 100 whose input is connected by a line 58 to the output of the amplifier 55.

The output 101 of the decoder 100 is also connected to the serial input 124 of a shift register 120 whose output is joined to the serial input 114 of a second shift register 110. The cell numbers of the registers 110 and 120 are respectively equivalent to the cell numbers of the registers 80 and 90. The parallel outputs of the registers 110 and 80 are applied to parallel inputs of a comparator 130. The output 131 of this comparator is stored by a memory 151. The output of this memory is an internal clock 152 and a logic "aND" 154. the internal clock 152 is adapted to generate pulses which are transmitted to the input 171 of a multiplexer 170. the output of this multiplexer is connected to input shift clocks of the three registers 60, 80 and 90.

The decoder 10₀ has a clock output 102 that is connected to the shift clock inputs of the registers 110 and 120 and to the input 172 of multiplexer 17₀.

The parallel outputs of the registers 120 and 90 are applied to parallel inputs of the comparator 140. The output 141 of this comparator is stored by a memory 150. The output of this memory is in the logic "AND" 154 whose output changes by intermediate inputs 164 and 173 respectively the state of multiplexers 160 and 170. the clock circuit 152 includes a counter that counts a number of pulses equivalent to the number of cells constituting all the registers 90, 80 and 60 before to issue a signal causing the reset of memories 151 and 150 and stop pulsing.

The encoder 54 is able to convert type signals _NRZ as shown in Figure 5A and reading from a serial register 60 of such differential bi-phase signal of the type shown in Figure 5B. In the latter each time a bit to the next is marked by a transition. In addition, the zero bits is a double crossover frequency of the level bits 1. This type of two-phase signals used to excite both in transmission and reception, the transducers 50 and 40.

In the circuit of Figure 3, the differential biphase signal of the type shown in Figure 5B sensed by the transducer 50 are decoded by the decoder 100 to produce, firstly, type of the data signals _NOTR_Z (Figure 5A) on the output 101 and on the other hand, the clock signals at its output 102.

In Operates in the transducer 40 (Figure 4) access control terminal 11 sends periodically, eg every 2₀0 milliseconds, a bit sequence or polling message. If a portable object 10 has been placed in front of the opening 36, this sequence is captured by the transducer 50 (Figure 3). The corresponding message appears at the output 85 of the decoder 84 and is stored sequentially in the shift registers 120 and 110, under control of the timing signal, the idle state of the multiplexers 160 and 170 establishing the links 161-163 respectively 171-174. At the end of this recording, the comparator 130 outputs a signal at its output 131, if the contents of registers 80 and 110 coincide. Otherwise, the reading of the portable object is not continued. This provides a first security against attempts to use portable objects unauthorized in the access system. Note that the bit transmission order of one of the registers 80 or 110 to the comparator can be modified by an appropriate wiring to encrypt the correspondence between the message from the terminal and the message contained in the register 80 in accordance with explanations given above for the connection between the register 60 and the display 16.

If the comparator 130 at its output 131 an enable signal, this signal is stored in 151 and the clock circuit 152 then allows the serial read information from registers 90, 80 and 60 and their transmission after coding by the encoder 54, by the transducer 50.

The multiplexer 160 is in position 161, 163, the registry 80 serial outputs of this information is automatically reintroduced into the registers 9₀, 80 and 60.

Information from the transducer 50 are received by the transducer 40 of the access terminal 11 that was at rest after the issuance of its interrogation message. The resulting message is transmitted through line 45 to a computer 1 o^g ed in the base 30 of the terminal. It shall verify the information collected.

The access terminal 11 transmits a message of re-registration of the portable object by the transmission line 46 to the shivering excitement tor 44 of the transducer 40. After transmission by acoustic signals to the transducer 50, the message is amplified and decoded recorded sequentially in the registers 120 and 110 under control of the timing signal from the decoder (output 102). If the comparison of the messages contained in the registers 110 and 80 is correct and that the comparison of the messages contained in the registers 120 and 90 indicates that the message that follows is a re (double protection) multiplexers 160 and 170 rock and new message is saved in series in the shift registers 90, 80 and 60 until they are completely filled. In this condition, the part of the message stored in the registry 60 boxes connected to the display 16 corresponds to a quantity of information, reflecting for example a number of points remaining to be used for access to the ski lifts requiring payment a number of points, the amount may be different from a rise to another.

Another information carried in the register 60 can be, for instance, a expiration date of the portable object.

The data contained in the rest of the register 60 and the register 80 may correspond to identification information of the nature of the portable object. As for the register 80 and / or 110, the wiring of one and / or other connections registers 90 and 120 to the comparator 140 can be scrambled.

At the end of the message causing the re-registration of registers 60, 80 et.90, the register 110 is initialized for a read sequence of the portable object, which then re-emits the new information stored in registers 90, 80 and 60 monitoring compliance of registrations, multiplexers 160 and 170 are again in position. If this check was inconclusive, a new sequence of rewriting can be attempted before opening the door. If the result of this check is satisfactory, a passage authorization signal may be issued on a command line 116 (Figure 2) to release a turnstile 110 controlling passage through an access corridor 112. To this end, a locking device 114 controlled by the control link 116 is provided on the turnstile 114.

The entire circuit shown in Figure 3 is integrated on a chip embedded in the plastic of the plate 12 forming the housing 12.

Figure 6 shows an alternative embodiment of the circuit of Figure 3 is particularly well suited in case the initial state of the shift register cells 60 is unknown at the time of power on the portable object, that is ie, when the battery 51 is charged therein. Was stored in Figure 6 the same reference numbers for identical elements. Suffice it to describe the elements that differ with their operation. Instead of a read register such as 80 mounted in series with the shift register 60, the portable object in Figure 6 comprises a read register 180, which is constituted by a ROM applying to the respective inputs of the comparator 230 reading an identification code reading invariable. In this example, it is constituted by three bits at level 1. The read comparator performs the comparison bit by bit between the contents of this register 180, and the contents of a register 210 equal to the register 110 of Figure 3 . Its output 231 controls the memory 151.

A write register 190 has its serial input 194 connected to the output 163 of multiplexer 160 and input 193 of timing connected to the output 174 of multiplexer 170. The serial output 191 of register 190 is connected to input 62 of the register 60. This data register 190 in this example comprises 16 cells. The parallel outputs of these cells are connected to the parallel inputs of a comparator bit to bit 240 by a link 241 whose wiring is scrambled as shown. The comparator 240 is, on the other, connected by a second multi-bit connection 242 to the parallel outputs of a shift register 220 serving as the shift register 120 of Figure 3 and of which the serial input 224 is connected to the data output 101 of the decoder 100 and the serial output is connected to the serial input 214 of register 210. the output 241 of comparator 240 is coupled to the input of the memory 150.

In operation, assuming that the battery 51 has been newly placed or replaced, the cell contents of the registers 60 and 190 is random and unknown.

The query from the terminal signal (Figure 7A) is composed of a series of bits comprised by synchronization bit level O (300 series) -Immediately followed by a train of three 302 bit compounds reading bits at 1. This signal is repeated periodically. When it is sensed by the transducer 50 of the circuit of Figure 6, the read control register 210 is loaded by three level bits 1. A coincidence signal appears at the output of the comparator 230 which is set to 1 the memory 151. as before, clock 152 is triggered and allows, by the timing inputs 63 and 193, the serial reading of the shift registers 60 and 190 whose content is unknown. This information is stored with the loop 65. The envelope of the read signal is shown schematically at 304 in Figure 7B. It follows the end of the process 302. The end of the read signal 304 is followed by a treatment time TT (Figure 7B) after which the device returns a new set of synchronization 300 followed by a train of 16-bit code 306. This writing process is composed of bits corresponding to the last 16 bits having been received by the terminal at the end of the query by reading the portable object. It corresponds in principle to the contents of the write register 190 taking into account the interference of the slopes of the link 241. The ter minal is informed of the scrambling code. Accordingly, the write code 306 is sent to the write control register 220. If this code is effectively the contents of the write register 190, the comparator 24₀ switches the memory 150. Accordingly, the loop 65 is open as in the case of Figure 3 (switching of the multiplexer 160). The train of pulses 308 immediately following the writing code 306 is then introduced into the registers 60 and 190 in series. It ends in 309 when the information of the records has been completely renewed. As before, a new polling signal read 300, 302, is sent by the terminal to cause a verification reading 304 (Figure 7_B).

The information entered in the register 190 was developed by the terminal. It may correspond to a valid code specially chosen from a very large number of codes. This code of validity may also result from some of the information entered into the memory formed by registers 60 and 190. At the next reading, this information will be taken into account by the terminal after checking the adequacy number of payment contained in the register 60 units and the other conditions of validity of the payment made by the portable object, forming a write control code. The latter, after checking the validity of code 19₀, Trigger the authorization of a new re-registration message. Thus, it is not possible to use this authorization for the registration of another portable object.

Although the contents of registers 60 and 190 can be read after the discovery of the code register 180 by any fraudulent, it will be extremely difficult for it to find the key giving access to the reinstatement of memory shift register.

Is shown for simplicity of explanation, the registers 60 and 190 separate from one another. In practice they may consist of a single register. We can also improve system security with a single shift register 365 (Figure 8) that stores all the information to be stored in the object and which is looped back on itself in a loop between 165 164 serial output and serial input 166 through a multiplexer 260 controlled in the same way as the multiplexer 160 of Figure 6. the write comparator 240 is replaced by a comparator 340 whose inputs 341-1 to 341-n are connected to n parallel outputs of the register 365 dispersed over the entire length thereof, as shown by the conductors of the link 342. this may be further scrambled by a suitable wiring as in the case of the link 241 Figure 6. the comparator 340 performs the bitwise comparison of the information on its inputs 341-1 to 341-n and those present on its inputs 343-1 to 343-n from a control register of writing 320 similar to the register 220 in its role and its connections. The position of n boxes 300-1 300-2, 300-n register 365 connected to the comparator 340 is known to all system terminals. They are therefore able to take in the order of temporal sequence of received bits read from the register 365 information on the validity of code contained in the register at a given stage of its use. This validity information is renewed with each re-registration. The bit cells 300-1, 300-2 to 300-n can of course be part of the relevant information stored in the register 365.

The structure of Figure 8 can be further improved if, instead of match to each of the n registers 341-1 to 341-n of the comparator 340, a single cell of the register 365, it is made to match more cells, for example three , numbered 302-1 to 302-3 in the case of the entry 341-1 of Figure 9, among p parallel outputs of the register 365. the connections between this input and the different cells (303-1, 303-2, 303-3) have fuses 305 which can be selectively melted by firmware so as to leave active one of 303-1 to 303-3 connections before commissioning the portable objects in memory. Of course, the terminals are adapted to the particular code adopted for melting fuses 305.

The fuse link system of Figure 9 may be replaced by a coding system or multiplexing 350 active type establishing a correspondence between a determined content of cells 302-1 to 302-p of the register 365 and the combination of signals on the registers 341-1 to 341-n of the comparator 340. in the case of Figure 10 for example, an encoder 351 receives four input signals corresponding to the content of 302-1 to 302-4 cells. It receives on its input 356 a signal that, according as it is present or absent, modifies the connection between the cells 302-1 to 3₀₂-4 352 and the output of the encoder connected to the input 341-1. This signal on the input 356 is itself dependent on the output signal 357 of an encoding device 355 connecting a plurality of cells of the register 365 to 341-2 input of comparator 340. The code key implemented by a circuit encoding 350 as is known reading devices. It achieves a difficult scrambling to drill correspondence between different bit of validity that may be registered in the register 365 and the control information to be applied in the register 320 to allow the reinstatement of the register 365.

Note that we have designed a very simple access control system having no mechanical moving parts, insensitive to magnetic fields, and can be easily protected against external actions.

This system is easy to use for users, especially but not exclusively in installations where it can control access. In particular, it does not require delicate handling operations portable objects it uses. It allows to minimize time lost in passing the control device.

The portable object is of inexpensive design since its memory circuit essentially consists of a shift register which is only subject to a reading and a re series to each check and this in conditions of satisfactory safety.

In the case where these objects are carried by users close to their body, for example using a strap, the electronic circuit is maintained at a substantially constant temperature which further improves the reliability of operation.

The system can be used for other applications as access control, eg accounting units of payment for gambling, horse racing, the parts production monitoring can be individualized by the choice of certain parameters (colors) or some options (automobiles for example).