NO301434B1 - Locking System - Google Patents

Abstract

A locking system which comprises a microcomputer controlled lock (10) with multiple level keying, i.e. multiple keys (34) having different functions in the locking system. A key reader (38), for example punch card or magnetic type, reads key code into the microcomputer. A read/write memory (217) has a predetermined number of assigned key codes stored therein and a read-only memory (215) has a control program stored therein for control of the microcomputer. An electrically controlled actuator (42) for the locking means is coupled with an unlocking output of the microcomputer. The control program comprises a main program and a plurality of subroutines each stored at a different location in the read-only memory. A function table (219) has a number of pointers each of which points to the memory address of one of the subroutines. The number of pointers in the function table (219) is equal to the number of locations in the key code memory (217). Decoding means operative under program control in conjunction with a control code (102) on the key (34) points to selected locations in the key code memory (217) and the function table (218) corresponding to the control code (102). A microcomputer (112), under control of the main program, compares the primary (104) and secondary key codes (106) from the selected key (34) with the assigned key at the location in the key code memory (214). If there is a match, the microcomputer then operates under the control of the subroutine at the memory address pointed to by the function table (219) to execute the function of the selected key (34).

Description

Scope of the invention.

This invention relates to a locking system as stated in the introduction in independent claim 1. In particular, the invention relates to a computer-controlled locking system which is specially designed to be used as a door lock.

Background for the invention.

Hotels, office buildings and the like require door locks on a large number of individual rooms. In a hotel, e.g. the door lock of each guest room must have a different key for subsequent guests. At certain times, the guest rooms' door locks must also be able to be operated by different keys belonging to the hotel staff, such as room staff, housekeepers and other hotel employees. For security reasons, the key to each lock must be able to be changed quickly.

There are previously known locking systems in hotels and the like that have been developed and which use electronic codes that correspond to logic circuits when operating a locking system.

US Patent No. 4,177,657 describes an electronic locking system that senses the code on a key and compares it with a code stored in a warehouse. When the key code matches the stored code, the lock activates a clutch-driven bolt, and can also change the stored code to a new code. The patent document describes a microcomputer controlled system for the lock. Each key has a management code, a primary key code and a secondary key code stored on it. A read/write memory stores a predetermined number of designated key codes and a read memory has a control program stored for controlling the microcomputer. A key reader is coupled to the microcomputer and is adapted to interact with any of the keys to read the code stored thereon into the microcomputer. The number of stored key codes in the lock is the same as the number of key levels to be used. Different keys are used for different access levels in accordance with the control code on the key. The access levels are specified as guest key, foreman, section manager, security manager, etc. If a code match is achieved, the system performs two main functions, namely enabling the link to allow the door to be opened and the stored code in the warehouse to be changed. In addition, there are special additional functions, namely a lock to prevent the code from being changed, a special key that can only be used once, and a double locking function.

US Patent No. 3,821,704 describes an electronic locking system which is suitable for hotels and the like and which has different levels of master keys. Each latch is controlled by a decoder circuit that has a binary store that can be changed. A key has two information fields that can be decoded, namely a key field and an authorization field. When the key field matches the combination stored in the decoding circuit's memory, the lock opens. If they do not match, the authorization field and the combination field are compared and if they are the same, the key field is stored in the warehouse and the lock is opened.

US Patent No. 3,797,936 describes an electronic locking system which is equipped with an optically coded key. If the key's code matches the stored code, the circuit activates a mechanism that opens the lock. US Patent No. 4,396,914 describes a microcomputer controlled lock. In this system, an electronic circuit compares the storage's contents with the combination code and releases the locking device if there is a match. If the key card is new, the circuit calculates a new combination code and if it matches the one on the key card, the new combination code is entered into the storage.

It is an object of the present invention to provide an improved safety device which is particularly adapted to be used to control a door lock mechanism and which overcomes various disadvantages of the previously known devices. Reference should also be made to Swedish patent document 429,884.

The locking system according to the invention is characterized by the features that appear in the characteristic in claim 1.

The specified embodiments of the locking system according to the invention appear from the independent claims 2-5.

Summary of the invention.

According to the present invention, an electronic locking system is provided which produces a high degree of security and which is easy to use and operate, and which nevertheless produces a high degree of flexibility in various applications, and which is also economical to manufacture and install. The locking system provides several level keys, i.e. several keys that have different functions in the locking system. A set or library of the key function program can be installed in each locking system. An operating set of selected key functions can be programmed into the locking system in accordance with the particular application. A different code key can be issued for each key function. The locking system can be used for various applications and is particularly suitable for use on hotel door locks.

The microcomputer is operated under the control of a start program, to establish or program said function table and to store key codes that correspond to this in the key code store. The system includes a device for assigning a pointer corresponding to the desired key function to each storage location in the function table, a startup, phase-in key, a code therein for controlling the microcomputer in the startup program's phase-in sequence whereby the microcomputer accepts incoming signals from subsequent key types of key readers and stores the key codes thereon in the places in the key code store corresponding to the control code on it. The device for assigning the pointers to the function table is in one embodiment an absence routine in the startup program. Optionally, a desired programming of the function table can be achieved by using a programming key with a pointer that is stored at each different storage location in the function table.

The locking system according to the invention can be used together with a conventional mortised lock which has a locking device in the form of a regular locking bolt and a latch, where the locking system is also equipped with a logic latch in the microcomputer to provide increased security. Furthermore, the microcomputer receives an input signal from a locking device detector to determine if a locking device is engaged, e.g. whether the regular bolt has been affected by turning the door handle. The microcomputer also receives an incoming signal from a physical relay device to determine whether the physical relay has gone into, e.g. locked position. The microcomputer also receives input from a battery voltage sensor so that an appropriate low battery warning can be generated. These incoming signals are used by the microcomputer under the control of the program to perform various key functions according to the program subroutines that correspond to the various functions.

According to the invention, a library of the key function subroutines is stored in the computer's read-only storage, and any one of a selected set of subroutines is executed by the microcomputer in accordance with the function table assignment and the corresponding key. One such key function subroutine includes the following: A guest key is operative to unlock the door except when the logical latch is set or the physical latch is turned on, but can be blocked by a latching bit part of a housekeeper's key. A housekeeper's key can be an opening or non-opening key, and if it is an opening key, it is subject to the logical order and the physical order. If it is a non-opening key, it can be used to block opening with the last guest's key. If the locking part is fitted, the relevant, issued key, which is a new key, will release the locking part and will open the door. The room staff's key is an opening key, which can be used on the logical line and the physical line. The room staff key subroutine checks the battery and if it is low and has been low for the last four times the room staff key has been used, it will not unlock the door without the key being entered twice in succession.

A central key is an opening key which, used on the logical and physical relays, will unlock the door only if it is a new key, i.e. used for the first time. An emergency key functions to engage the logic rail, and will unlock the door regardless of the position of the rails, in that, when the door knob is turned, it will clear the logic rail. A rephase key switches on the logical line, running from the remaining cycle time and sets up the rephase procedure whereby a new code can be stored in the key code store when another key is introduced. A combination of the first security key and the second security key produces an increased degree of security, in that the first security key must be used first and is operative to switch on the logical line, and if the next key is the second security key, it unlocks the lock if it is an opening key. A free key to the hotel is equipped with a hotel code and is operative to unlock such doors that give access to common hotel areas, such as swimming pools, playrooms, etc.

Arrangements are also provided to ensure that a new key code will be stored in the storage of a new key even if the previously assigned key has never been used. This is provided by using a primary code, secondary code and a link code on the key. Furthermore, devices are provided for direct reprogramming of the lock. According to the invention, a time base is also provided for recording subsequent operations on the lock. Additional key function subroutines are stored in the read storage. Such additional key functions include: an office door key function with jamming, non-jamming and flipping operations particularly adapted to an office door lock, a security key function which uses a simple key sequence, and a lockout function which causes keys at a level above or below a predetermined level to be temporarily rendered inoperative.

The invention will subsequently be described in more detail with reference to the accompanying drawings.

Description of the drawings.

Fig. 1 shows a door lock design according to the invention installed in a door. Fig. 2A shows a side view, partially in section, of a door handle and a lock housing surrounding the microcomputer-controlled lock. Fig. 2B shows a rear view of parts of the lock control mechanism.

Fig. 2C shows a typical code arrangement on a key.

Fig. 3A shows the microcomputer and the electronic control circuit. Figures 3B and 3C show functional block diagrams of part of the microcomputer. Figs. 4 to 5, 6A and 6B and 7 to 14 show flowcharts illustrating the microcomputer's control program in a first embodiment of the invention. Fig. 15 shows a magnetically coded key which is used in a second embodiment of the invention. Fig. 16 shows an electronic circuit for the second embodiment of the invention. Figs. 17A, 17B and 18 to 21 show flowcharts illustrating the additional control program for the microcomputer in a second embodiment of the invention.

Fig. 22 shows special details of the microcomputer.

Fig. 23 shows the microcomputer and an electronic circuit in a third embodiment of the invention. Fig. 24 shows part of the directly accessible storage in the third embodiment. Figures 25A and 25B show a flow chart illustrating a chain code program for verifying the validity of a new key. Figures 26A, 26B, 27, 28A, 28B and 29 show flowcharts illustrating control programs for the key functions in a third embodiment of the invention. Figures 30A, 30B and 30C show a flowchart illustrating the control program for a direct reprogramming of the lock in a third embodiment. Fig. 31 shows a flowchart illustrating a real-time clock for providing a time-based registration of door opening.

The best embodiment of the invention.

Reference will now be made to the drawings, where an embodiment of the invention is shown in a microcomputer-controlled locking system for use in a door lock in a hotel. It will be understood as the invention is further described, that the invention can be used in many other places, and can be used in various embodiments.

A first embodiment, where a punch card key is used, will be described first. Next, a second embodiment where a magnetic coded key is used will be described. Finally, a third embodiment will be described which includes a time-based recording of locking operations, direct reprogramming and additional key functions.

Fig. 1 shows the invention's locking system or control system installed in a door lock used in a hotel. A door lock 10 is installed in a door 12. It usually comprises a conventional mortise lock 14 installed in the door, an external door twister 16, an internal door twister 18, and a lock control system 22. The lock is equipped with a locking device in the form of an ordinary retractable bolt 24 which is actuated via the door turner shaft 26 and which can be acted upon directly via an internal door turner 18 or can be acted upon via the lock control system 22 with the external door turner 16. The lock also includes a rail 28 which is actuated via a rail control 32 on the door inside via a pulley shaft 34. In the same way as with conventional locks 14, the pulley 28 is retracted at the same time as the bolt 24 is retracted by the action of the internal or external door handle. A key 34, in the form of a punch card, is part of the lock control system 22 for starting the manual control of the lock, which will be described in detail later.

The lock control system 22 is shown in more detail in fig. 2A and 2B. Typically, it comprises a lock body 36 surrounding a key reader 38, an electrically controlled actuator or lock control mechanism 42 and a microcomputer circuit board 44. It also contains a set of indicator lamps comprising a green LED (light emitting diode) 46, a yellow LED 48 and a red LED 52 which can be seen through a window 54 in the locking body. A pair of batteries 55 are installed in the body 36.

The key reader 38 includes a slot 56 adapted to receive the key 34 and a key switch 58, which is actuated to a closed position when the key is fully inserted and is actuated to an open position when the key is withdrawn. The key reader 38 is an optical reader adapted to detect the presence or absence of punched holes in the key 34 and will be described in more detail hereinafter.

The lock control mechanism 42 comprises a lock pin receiver 62, a reverse lock pin 64 and a solenoid 66 for actuating the lock pin. The locking pin receiver 62 is a disc-like member which is non-rotatably mounted on the door turner shaft 26. The upper half of the locking pin receiver 62, as shown in FIG. 2B, has an increased radius and is provided with a circular recess 68 in line with the locking pin 64 with the door handle in the neutral position. When the locking pin 64 protrudes or is guided into the recess 68, the door turner shaft 26 cannot be turned by the door turner and consequently the bolt 24 cannot be retracted and the door remains locked. The locking pin 64 is cylindrical with a head 72 at the upper end and is connected via a pivotable coupling 74 to the armature 76 of the solenoid 66. The locking pin 64 projects through a control console 78 which is mounted on the locking body and the locking pin head 72 rests on the console when the locking pin is down. The lock control mechanism 42 also includes a locking device detector in the form of a door knob detector 82 which is arranged to produce a signal when the door knob is turned. The doorknob detector 82 includes a reed switch 84 mounted on the circuit board 44. It also includes a switch actuator comprising an arm 86 rotatable with the doorknob shaft 26 and carrying a permanent magnet 88. When the doorknob 16 is rotated, the arm 86 is moved with the shaft 26 to a position where the magnet 88 is distant from the reed switch 84 so that the reed switch 84, which is normally open, thereby closes. The lock control mechanism also includes a bolt detector 92 which is arranged to develop a signal indicating whether the bolt has been engaged or retracted. It comprises a reed switch 94 which is mounted on the circuit board 44. It also comprises an arm 96 which is mounted for rotation with the pulley shaft 34. The arm 96 carries a permanent magnet 98 which is thereby placed against the reed contact 94 when the pulley is in its retracted position. The reed contact 94 is normally open and by rotation of the shaft 34 the reel is fed in, and the magnet 98 is again fed from the reed contact 94 which is thereby influenced to its closed position.

The key 34 shown above will be described in more detail with reference to FIG. 2C. Various keys of the type shown in fig. 2C can be issued to be used on the same lock and some can be used on more than one lock, as will be described below. In a hotel lock system, several of the staff, in addition to the guests, require keys for various operations on a given lock. In an illustrative system, there are eight different types of keys: Guest key, room staff key, household key, room key, central key, tamper-proof key, master zone key and emergency/rephase key. Each key is an opaque card which is equipped with three different code fields 102, 104 and 106. Each small rectangle on the card in fig. 2C represents a bit position. If the bit position is a punched hole, it is a one bit, if it is not a punched hole, it is a zero bit. The code field 102 is encoded with a control code comprising a field or four bit characters. The three upper bit characters represent the key's level or function. The fourth bit is called the opening bit and when it is a one bit the key is an opening key and when it is a zero bit it is a non-opening key. Code field 104 contains a 16-bit key code or character arranged in four columns and represents the lock's primary key code. The code field 106 contains a 16-bit key code or character, which is also arranged in four columns, and represents the lock's secondary code. The bottom row of bits constitutes synchronization bits for self-clock setting of the key reader. An one bit is used in the synchronization bit position only if there is no one bit in the particular column. Before the function and treatment of the various types of keys are described in more detail, the microcomputer control circuit will be described.

The microcomputer lock control circuit will be described with reference to FIG. 3A. The microcomputer 112 is a single chip (with integrated circuits), four-bit microcomputer, which in the embodiment shown is from a series MB84400 and MB88500 manufactured by Fujitsu Limited of Japan. The key reader 38 is controlled by and produces incoming signals to the subsequent microcomputer 112. The key reader 38 is an optical reader equipped with a first pair of infrared LEDs (light emitting diodes) 114 and 116 for use when reading the first and second rows of bits of data, on the code field of the key. A second pair of LEDs 118 and 122 are positioned to be used when reading the third and fourth rows of the data bits. An LED 124 is positioned to read the synchronized data bits on the key's code field. The LEDs mentioned above are activated via a switching transistor 126 which has its base connected via a resistor 128 to the computer pin R3. The emitter of the transistor 126 is connected to the positive output of the battery and the collector is connected to the three sets of LEDs via resistors 132, 134 and 136. The key reader 38 includes five sets of phototransistors 142, 144, 146, 148 and 152. The phototransistors 142 and 144 is optically aligned with LEDs 114 and 116 respectively, and is connected to data pins DO and D1 on the microcomputer. The phototransistors 146 and 148 are optically aligned with the LEDs 118 and 122 and the collectors are therefore connected to the data pins D2 and D3 respectively. Phototransistor 152 is in line with LED 124 and its collector is connected to the microcomputer's auxiliary clock pin.

The relay detector's switch 9 4 is connected between earth and a pin RIO. The door twist detector's switch 84 is connected between ground and a pin R9. The key switch 58 is connected between a voltage source and the start pin of an IRQ pin across a resistor 156 to ground. The microcomputer's reset pin is connected to the junction between a resistor 158 and a capacitor 162 connected in series across the voltage source. A resistor 164 is connected between a clock generator's external pins X and EX and a capacitor 166 is connected between pin EX and ground.

A supply voltage line 168 is connected via a switching transistor 172 to the battery voltage. The base of the switching transistor 170 is connected to a pin R2 via a resistor 174. A pin RO is connected via a resistor 176 to ground. The solenoid 66 is controlled by the microcomputer via an unlocking output comprising pins 04 and 05. For this purpose, the upper end of the solenoid 66 is connected to the battery and its lower end is connected via a switching transistor to ground. The switch transistor 178 is controlled via a switch transistor 182 which has its collector connected via a resistor 184 to the supply voltage line 168 and its emitter connected to the base of the transistor 178. Transistor 182 is connected to contact pin 04. When contact pin 04 goes up, both transistors 182 and 178 turn on, and an inrush current is supplied to solenoid 66 sufficient to retract latch pin 64 to unlock the door. The lower end of the solenoid 66 is also connected via a switching transistor 186 to the contact pin 05. The solenoid is particularly connected via a resistor 188 to the collector of the transistor 186 which has its emitter connected to ground and its base connected to the contact pin 05. When the contact pin 05 goes up, the transistor is turned on 186 on and the solenoid draws a holding current sufficient to maintain the locking pin 64 in the retracted position.

The green, yellow and red indicator LEDs (light emitting diodes) 46, 48 and 52 are respectively controlled via an O port which will now be described. The green LED 4 6 is controlled by a contact pin 00 via a comparator 192. The green LED is particularly connected between the battery and the output of the comparator via a resistor 194. The contact pin 00 is connected to the comparator 192's non-inverted input. The voltage supply line 168 is connected across a resistor 196 and a series of diodes 198 and the voltage across the diode is used as a reference voltage for the inverted input of the comparator 192. The yellow LED 48 is controlled by contact pins 01, 02 and 03 which are connected in parallel with each other for increased current capacity through a series resistor 202 to the LED 48. The red LED 52 is controlled by contact pins 06 and 07 which are connected in parallel with each other and via a resistor 204 to LED 52.

The low battery detector for observing low battery voltage is controlled by the microcomputer contact pin R1 and comprises a comparator 206. In particular, a pair of voltage divider resistors 208 and 211 are connected between the voltage supply line 168 and ground. The junction of the voltage dividing resistors is connected to the comparator 206 non-inverting input. The inverting input is connected to the reference voltage shunted across the diode 198. A contact pin Rl2 is connected to ground via a resistor 213. When the voltage at the non-inverting input of the comparator 206 falls below the reference voltage at the inverting input, the output of the comparator 206 goes down and the output from there is applied to contact pin Ril.

The microcomputer 112 will be further described with reference to Figures 3B and 3C. The microcomputer includes a read-only memory (ROM) 215 which stores the operating program for the locking system shown by the flowcharts shown in the drawing. The read storage 215 is shown in more detail in FIG. 22 which will be described in more detail later. In addition, the microcomputer has a read/write storage, i.e. direct storage (RAM), which is used for various registrations, counters and storage blocks. In particular, as shown in fig. 3B, the direct storage includes a key code storage 217 containing 32 characters divided into eight different levels of four characters each. level. This store stores a key code at each level that corresponds to each of the keys' eight different levels. When either the primary code or the secondary code on a key is matched to the key code for the key's particular level, the lock will be operative to respond to that key. The direct storage also includes a function table 219 which comprises eight characters which are divided in accordance with the management code of the key to be transferred to the specific level of the key in the key code storage 217. An additional storage block 221 is used to store operational data as a backup storage ). It stores the key code store, function table, opening bit, etc. An operational status control store 223 is arranged in the direct store and includes cycle time and state registers. The status registers include the lights from the red, green and yellow indicator LEDs and the solenoid.

In addition, the direct storage includes various registers and counters as shown in fig. 3C. A four-bit register 225 includes a "new" bit flag 227, a logic rail flag 229, an opening flag or bit 231, and a stock compare flag 233. The use of these bits during operation will be described below. In addition, a blocking register 235 comprises four different blocking bits which are used when using the housekeeper's key to prevent the use of a previously issued key to a guest, as will be described below. A room staff key counter 237 is used to keep track of the number of times the room staff key is used to open a door at the same time that the low battery warning light is triggered. An error reading counter 239 counts the number of subsequent attempts to use a key that is not adapted to the lock's key code store. A history buffer includes a key type register 241 which records the last various key types used (except for non-opening keys), as will be described below. It also includes a repetition counter 243 which counts the number of repetitions of the last opening key. A type and format register 245 registers the type and format of the key that was last used (whether it is an opening key or a non-opening key). Application and operation of these registers will be described later.

The microcomputer's read storage and direct storage are shown in further detail in fig. 22. The read storage 215 comprises a program storage 800. This storage stores a main program and a number of subroutines at specific storage locations, which will be described in the following. The read storage also stores a first decoder or unlocking table 8 02 and a second decoder or unlocking table 804. The function and operation of these unlocking tables will be described later. The microcomputer's direct storage includes a control code register 806 which is arranged to keep the control code reading from the key in progress. As indicated above, the direct store contains a function table 219 and a key code store 217. As shown, the function table 219 is an eight character table shown with eight different levels or storage locations designated from zero to seven with a different character at each level. Each character is a four-bit pointer which for each function is associated with the unlock table 802, to point to the storage address of one of the subroutines in program storage 800. The key code storage 217 is also shown with eight different levels, designated from zero to seven. Each level or storage location stores a 16-bit key code. In addition, the direct store includes a hotel code register 808, a cycle time flag 812, and a flag to indicate actuation of the locking device, i.e., a doorknob rotation flag 814.

However, when the key code is read into the microcomputer from the key reader, the control code is stored in the control code register 806. The four-bit control code acts as a pointer and is decoded by the unlock table 802 which is operative to point to one of the eight levels of the function table 219 and to the corresponding level in key code store 217. thus, the control code is operative to enter the key code in key code store 217 which must be compared with the code read from the key. The four-bit pointer in the function table 219, which is indicated by the control code, is at the same level as the indicated key code. This four-bit pointer is obtained by using the second unlock table 804 to designate the subroutines in the program store 800 that correspond to the key function.

Operation of the lock will be described with reference to the flowcharts shown in fig. 4-14. The flowcharts represent various operating programs stored in the microcomputer 112 read stores 222.

Fig . 4 shows a flowchart presenting the lock's startup program. The operating system's start block 210 is operative to start up the microcomputer 112 and the electronic control circuits 44. This start-up state occurs when the battery is connected to the latch circuit which creates a cold start of the system. When the system has been started, the program proceeds to test block 212 which determines whether any part of the system has a malfunction. If it has, it returns to the starting block 210, if it has not, it continues to the next allocated level, namely to a block 214 which sets up a standard design of the allocated levels in the key code store. As described earlier, the key code storage 217 in the direct storage has eight different storage locations or levels and each level stores a key code. Also, a function table 226 in the direct storage has eight different storage locations or levels, each of which represents a particular function that can be performed in response to a key corresponding to that level. In an illustrative embodiment, the default layout of the eight differently assigned levels may look as follows:

Stock Level 1: Card Type C, Guest #1,

storage level 2: card type B, central,

storage level 3: card type A, shatterproof,

warehouse level 4: card type D, housekeeper/barred guests, warehouse level 5, card type A, master for assigned zones, warehouse level 6: card type F, emergency/rephase,

storage level 7: card type C, guest #2 (suite)

inventory level 8: card type E, room staff.

With the default layout established as stated above, the program proceeds to an input block 216 where the system waits for a key to be inserted. At this point in the boot procedure, the only key that will be effective to insert is an initial or boot rephase key which, as will be described below, is used as a preparatory step in assigning specific key codes to the various storage levels . If a test block 218 determines that the inserted key is not a rephase key, the program returns to block 216 and waits for a new key to be inserted. If there is a rephase key, the program proceeds from block 218 to a block 220 which prepares the logical line, i.e. it sets the logical line bit to one. The program then proceeds to an input block 222 and waits for a key to be inserted. At this point in the start-up procedure, the lock is ready to receive assigned key codes written into key code storage 217 at storage locations designated to be the same locations used at function table 22 6 in accordance with the assigned storage level. In other words, a special key code is written into the storage at a location corresponding to level 1 for the guest number 1 function, a special key code is written into the storage for level 2 for the central function, etc. When the system receives an inserted key, the program runs on to block 224 and the secondary code from the key is written into key code store 217 at a level corresponding to the key level or control code encoded on the key. This procedure, shown at block 224, is repeated for each separate key inserted. After a key is inserted, it is processed by block 224 and then a shutdown routine 234 brings the system to stand-by. The test block 226 determines when all levels have been executed. The different keys corresponding to different storage levels can be inserted in any order. This application of key code phasing is essentially the same as when rephasing the locks (changing the key code to one or more levels) which will be described in detail later. Upon completion of this phasing sequence at block 224, the program proceeds to a block 234 that transitions the system to standby to await the next key. When a key is inserted at an input 228, the program proceeds to a test block 230 which determines whether it is an emergency key. If it is not, the microcomputer will process the inserted key, but then the program will return to input 228. If it is an emergency key, the program proceeds to a block 232 which clears the logic line. This location prepares the lock for use and the program proceeds to a lock routine 234 which places the system in a standby position to await the next key. This completes the start-up procedure and the lock is ready for use. Usually, this start-up procedure is performed at the factory so that the lock is ready for use when it is installed in a door. If desired, this start-up procedure can be performed after the lock has been installed.

Reference should be made to fig. 5, where operation of the lock will be further described. As described above, the initialization procedure makes the lock ready for use by any of the various keys that have been phased into the lock. After the start-up procedure, the lock is in a stand-by position waiting for a key to be inserted. The operation, which is shown by the flow chart in fig. 5, is the same for all the different keys to be used on the lock. At the input block 240, a key is inserted and the program proceeds to a block 242 which starts up the cycle time unit in the microcomputer. After the key has been inserted and the ignition switch activated, the cycle timer provides 5 seconds for the nine bits of data to be transmitted from the key and for the door handle to turn. Typically, a key is read in less than one second, depending on the withdrawal speed (the operation that takes place during the remaining time will be described below). From block 242, the program proceeds to a block 244 which causes the microcomputer central processing unit to test the data integrity of the stored units. In this test, the existing units are compared with the stored units when the lock is transferred to the stand-by position. If there are any errors, the processor unit attempts to recover this and the program moves on to a block 24 6 which introduces a time delay to allow the LEDs to be switched on. Then block 248 waits for a data change. When the key at an input block 250 is withdrawn, the starter switch is opened. This causes the program to proceed to a block 252 which transfers the code from the key. This includes the nine characters that make up the control code, the primary code and the secondary code from the code reader. The program then determines whether a valid nine characters have been transmitted. To determine this, the program proceeds to a test block 254 which determines whether the code reader has registered a tenth character with an en-bit position which is the code reader's correct status after performing a correct read of the nine encoded characters on the key. In other words, upon withdrawal of the key whereby the nine characters are subsequently recorded, the card reader shall record all (all bit positions) following the nine characters when the opaque key releases the reader. If the tenth character is not a one, it is indicated that there is an incorrect reading which may be the result of incorrect movement of the card or similar. If the character is not a one, the program moves on to a block 255 which increases the error (wrongly read) counter 23 9. The program then moves on to the closing routine 234 which causes the system to go to stand-by position and wait for the next key. In the event of a bad or incorrect reading of the key, the key must be re-entered and the program must be repeated from block 240. If the tenth character is a one, the program proceeds to block 2 55 which evaluates the battery status. If this is not low, it continues to a block 2 60 in fig. 6A. If it is low, the program moves on to block 257 which displays the low battery status indicated by a red LED. The program then proceeds to block 260 in FIG. 6A which will be described in what follows.

The program shown by the flowchart in fig. 6A and 6B are a continuation of the program in fig. 5. It is also used when operating the lock with different keys that have been phased in at different levels in the key code store. In other words, keys that are of type A-F at one of levels 1-8 will cause the microcomputer to operate in accordance with the program of FIG. 5 and also in accordance with the continuing program in fig. 6A and 6B. As described with reference to fig. 5, upon obtaining a valid reading of the nine characters encoded on the key, the program proceeds from block 257 of FIG. 5 to block 260 of Fig. 6A. Block 2 60 uses the first character, representing the level code, with table 219 in the store to obtain a pointer or address for the stored key code's storage location in key code store 217. Next, a test block 261 determines whether the last key was a rephase key. If so, the program moves on to a test block 2 64, if not the program moves to a test block 262 which determines whether the key's primary code is adapted to the code stored in the key code store. If the answer is yes, the program moves on to test block 2 64 which determines whether the second code is a one, i.e. equal to minus one. A second code with ones is only used in connection with the emergency/rephase key, which will be described later. If the test block 2 64 determines that the second code is not ones, the program proceeds to a test block 2 66 which determines whether the key code storage is set with only ones. (A key code store is attached only to ones if a lock is taken out of use and is otherwise not used as a valid code.) If test block 2 66 determines that the key code store is not only ones, the program proceeds to block 2 68 which transfers the secondary code from key to key code store and it replaces the previously stored key code. The program then proceeds to block 270 which sets the "new" flag 227 to indicate that the key is new, ie being used for the first time. From block 270, the program proceeds to a test block 272 which determines whether the second code is matched to the key code stored in the store. If it is, the program proceeds to block 274 which frees the erroneous read or error counter 239 described above, (The use of the error counter will be described later.) After freeing the error counter, the program proceeds to block 276 which causes the program to to branch to special subroutines for the level corresponding to the pointer produced at block 260.

In the operational description given so far, with reference to fig. 6, conditions are assumed which cause the program to proceed straight through from block 260 to block 276. If it is demonstrated at test block 2 62 that the primary code is not equal to the key code stored in the storage, the program will proceed from there to test block 272 which demonstrates whether the other code is adapted to the warehouse. If it is, the program continues as before to block 274 and then to block 276 where the program branches. There is another condition, not previously described, that will cause the operation to continue to block 276 where the program will branch. This condition is as follows: If test block 2 62 determines that the primary code is matched to the warehouse and the secondary code is only ones, as demonstrated at block 264, the program will proceed to test block 278 which determines whether the last opening type key was an emergency key, if the if it is, the program proceeds to test block 280 which determines whether the last key inserted was the rephase key. In that case, the program proceeds to block 2 68 which transfers the secondary code to the store and the program proceeds via blocks 270, 272 and 274 to block 276 where the program branches. The preceding condition is one that will occur when it is desired to obtain an overview of the application at a given level by producing all at the key code store level. There is also another state of operation of the system, in accordance with the flowchart in fig. 6, in which the program will proceed to block 276. If test block 262 determines that the primary code matched to the store and test block 2 64 demonstrates that the secondary code is not only ones while test block 2 62 determines that the key code store is only ones, the program will proceed to test block 278 which determines whether the last opening key was an emergency key. If it was, block 280 determines whether the last key inserted was a rephase key. In that case, the program will proceed to block 2 68 which transfers the secondary code to the storage and then the program will proceed to blocks 270, 272, 274 and 276 in which the program extends as previously described. The latter condition can be achieved when the stock has previously been set to only ones to disable the latches at particular levels. But if the procedure just described where test block 2 64 proves that the secondary code is only ones or test block 266 proves that the warehouse is only ones, while test block 278 proves that the last opening key was not the emergency key, or test block 280 proves that the last key was not the rephase key, this will indicate that the lock is not out of use, and that a lock that has previously been out of use has not been rephased again. Consequently, the program goes from block 278 to the shutdown routine 234 and brings the system to stand-by.

If the program in fig. 6 goes on to test block 2 72 and it is thereby proven that the secondary code is not adapted to the storage, the program will go on to block 282 which increases the error counter 239. The error counter, as previously described, is used to record the number of times a key is used in the lock without producing an adaptation for the secondary code of the warehouse. This may be the result of the wrong key, or it may be the result of a fault with the computer reader as shown in the program according to fig. 5. If a key is inserted more than eight times with eight subsequent failures to obtain a custom code, it is desirable to try to prevent further attempts due to the possibility of tampering with the lock. Therefore, the program proceeds from block 282 to test block 284 which determines whether the error counter is greater than eight. If it is not, the program proceeds to the closing routine 234 which causes the system to go to stand-by position and wait for the next key. If the error counter is greater than eight, the program proceeds to block 288 which initiates a time delay in status controller 223 for five seconds to prevent reading data from a key at block 252 in FIG. 5 until five seconds have elapsed. It should be noted that the error counter 239 is released at block 274 whenever a code match is detected at block 272.

When the program in Figures 6A and 6B reaches block 276, as described above, it branches to the subroutine for the level corresponding to the pointer registered at block 260. The subroutines corresponding to the various levels will now be described.

If the key that was inserted at block 240 in fig. 5

was a guest key, either guest #1 at level 1 or guest no.

2 at level 7, the program will branch at block 276 in FIG. 6B to block 300 in FIG. 7. Fig. 7 shows the program or subroutine for a guest key. The purpose of the guest key is to unlock

the lock except when the physical latch is engaged, the logical latch is engaged, or the locking operation is inhibited due to the interlock bit being engaged for the level of the inserted key. The locking piece can be fitted by a previously inserted housekeeper card (non-opening version) to prevent unlocking with a previous guest's key. Such a method can be used as a safety precaution to prevent guests who have checked out from entering the room again. Application of the housekeeper key system will be described in more detail later. At this point it is sufficient to say that the housekeeper key (the non-opening version) is effective in setting all the latch bits in the latch register 235. As described earlier, the latch register only has two active latch bits since there are only two guest levels assigned in

the function table, namely levels 1 and 7, for the lock being described. When a new guest key is distributed, as in the example of the inserted key at block 240, it must be operative to release the locking bit at its level, if such a bit is set.

The guest key program is shown in fig. 7. As described above, the guest key function can be assigned more than one level. The blocking register contains four bits that can be individually assigned to the guest key level. Thus, it must be determined at the outset which locking bit corresponds to the inserted guest key. To this end, the starting block 300 counts the guest functions under its own position in the function table. The matching latch bit is in the same relative position as the guest key level. The program then proceeds to test block 302 which determines whether the disable bit is set for the level of the key being processed. If it is, the program proceeds to test block 304 which determines whether the "new" flag is set. If it is not set, then it means that the key being processed is not a new key, and the program proceeds to block 306 which lights the yellow LED and indicates that the key code was matched, but that the door will not be unlocked. If test block 304 determines that a new flag has been set, the program proceeds to block 308 which releases the latch bit for the level of the key being processed. The program then proceeds to test block 310 which determines whether the logic latch is set. If test block 302 determines that the latch bit was not set, the program will proceed to test block 310 to determine whether the logic bit is set. If it is, the program proceeds to block 306 to light the yellow LED. If it is not, the program proceeds to test block 312 to determine whether the physical relay is set. If it is, block 3 06 lights the yellow LED. If it is not, the program proceeds to 314 which charges the solenoid. The program then proceeds to test block 316 which determines whether the cycle time has expired. If it has, the program proceeds directly to block 234 which starts the closing routine which will be described hereinafter with reference to FIG. 8. If the cycle time has not expired, the program will proceed to test block 318 which determines whether the door knob has been turned. If it has not been, the program returns to test block 316. If the door knob has been turned, the program continues to the door routine 234.

The bar routine is shown in fig. 8. Usually, it is designed to register or store various data with regard to the last history of the locking operation and then to place the lock in a stand-by position. The recording of the history of the lock operation in the lock storage enables subsequent storage dumping for such purposes as analysis of security or for diagnostic purposes. The stock dump includes identification to determine which of the eight opening type keys was used to open a particular door. The opening repetition counters 243 are arranged to record the number of subsequent door openings, up to a maximum of e.g. 15, for the last different keys used at the opening (e.g. five). The closing routine 234 starts with a block 328 which determines whether the door knob has been turned to open the door, i.e. whether the door has been opened. If it has not been, the program proceeds to test block 329 which determines whether the time delay has expired. If so, the program proceeds directly to block 334 and skips the recorded steps. If it has not expired, the program returns to block 328. If block 3 28 determines that the door knob was turned, the program proceeds to block 330 which determines from the key type register 241 whether the key processed is at the same level as the last used key for to open the door. If the answer is no, the program proceeds to block 332 which fills new data into the history buffer which includes the repetition counters 243 and registers a zero at the level of the key being processed. The program then proceeds to block 334 which will be described below. If the answer to test block 330 is yes, the program moves on to test block 336 which determines whether the repetition counter 243 compared to the level of the key has been treated equally 15 times. If the answer is yes, the program proceeds to block 334. If the answer is no, the program proceeds to block 338 which increments the counter and then the program proceeds to block 334. Block 334 closes power to the external devices including the solenoid and the LEDs. The program then moves on to book 340 which enters data into the status control 223 in the direct storage to store the lock's

existing state or status. This stored status is then used as reference data to ensure that

the status is entered again when the lock is next activated. After block 340, the program moves on to block 342, which puts the lock in a stand-by position to wait for the next key. The blocking routine just described is used in conjunction with others

keys, the operation of which will be described later.

If the room staff key is inserted at block 240, the program will branch to block 27 6 to the room staff key sub-routine which is shown on the flowchart in fig. 9. The room staff key assigned to level number 8 in the function table is intended to be used as an opening key for several rooms, e.g. all rooms on the same floor of the hotel. In addition, the room staff key is used to notify the room staff that the lock has a low battery condition so that it can be replaced in time.

The room staff key program starts at block 360 which determines if the battery is found to be low. If so, the program proceeds to block 3 62 which increments the room attendant key counter, which, as previously described, counts the number of times the door has been opened by the room attendant key while the battery is in a low state. The program proceeds to block 3 64 which determines whether the room staff key counter is equal to 4. If so, the program proceeds to test block 3 66 which determines whether the last key was the room staff key. If it was not, the program proceeds to the closing routine 234 as previously described, and waits for the next key. thus, inserting the room attendant key will not open the door after the solenoid has been charged and the door opened (the door knob turned) four times by the room attendant key with a low battery. To open the door under such conditions, the room staff key must be inserted twice. If test block 366 determines that the last key was the room staff key, block 368 lights the red LED and then proceeds to test block 370. Test block 370 determines whether the logic relay is set. If it is not, the program proceeds to block 374, which determines whether the physical relay has been engaged. If it is not, the program proceeds to block 376, which charges the solenoid. Then the program executes the lock routine 234 and waits for the next key. If test block 360 determines that the battery is not low, the program proceeds to block 378 and frees the room staff key counter and the program proceeds to block 370 and continues as described above.

If the housekeeper key is inserted at block 240, the program will branch to block 276 to the housekeeper key subroutine shown in the flowchart of FIG. 10. The housekeeper key is provided in two different versions, an opening version and a non-opening version. Both key versions can be used in a number of different locks, e.g. on the locks of all the hotel's guest rooms. The unlocking version of the housekeeper's key is used to unlock the doors and gain access to the rooms. The non-opening version is used to lock out the previous guests by putting on locking pieces so that a new guest key must be used to unlock the door. The housekeeper key subroutine begins with block 390 which determines whether the opening bit (one of the first character's bits) is equal to one. If so, the key is an opening version and the program proceeds to test block 392 which determines whether the logical latch is set. If it is, the program proceeds to block 294 which lights the yellow LED and then the program proceeds to the latch routine 234. If the logical bolt is not set, the program proceeds from block 392 to block 396 which determines whether the physical bolt is set on. If it is, the program moves on to block 3 94 to light the yellow LED. If it is not, the program proceeds to block 398 which charges the solenoid. If it is determined at test block 390 that the opening bit is not equal to one, the program proceeds to block 4 00 which sets all blocking bits equal to one. The program then proceeds to block 394 which turns on the yellow LED and the program proceeds to the closing routine 234.

If a central key is inserted at input block 24 0, the program will branch to block 276 to

the central key subroutine. This subroutine is shown by the flowchart in fig. 11. The purpose of the central key is to unlock the door once and only once. It can be used, e.g. to give a repairman access to the room while ensuring that it cannot be used subsequently to gain access to the room. The central key subroutine starts with test block 410 which

determines whether the "new" flag is set. If it is not set, which means that the key has been used previously, the program runs

continue to the closing routines 234. If a new flag is set, the program moves on to test block 414 which determines whether the logical line is set. If it is, the program proceeds to block 412 to light the yellow LED, otherwise the program proceeds to test block 416 which determines whether the physical relay is set. If it is, the yellow LED lights up, otherwise the program goes on to block 418 which charges the solenoid and the program goes to closing routine 234.

If a mixing key is inserted at input block 240, the program will branch at block 276 to mixing subroutines which are shown in the flowchart in fig. 12. The combination key is assigned to level 5 in the key card storage table to be used as a master opening key for a designated zone or group of rooms. The combination key is also assigned a level three in the storage table and is used to function as a tamper-proof key in case, e.g. a guest key cannot be produced due to a malfunction of the equipment or in an emergency situation such as a power cut at the hotel. The combination key, whether it is a tamper-proof or zone key, has the function of being able to unlock the door when the logical or physical lock is not set. The housekeeper's key cannot prevent unlocking with a combination key.

The mix key subroutine starts with test block 430 which determines whether the logical line is set. If it is, the program proceeds to block 432 which lights the yellow LED and the program proceeds to the shutdown routine 234. If the logical relay is not set, the program proceeds to test block 434 which determines whether the physical relay is set. if it is, the yellow lamp lights up, otherwise the program goes to block 43 6 which charges the solenoid and the program goes to the closing routine 234.

If the emergency/rephase key is inserted at input block 240, the program will proceed to block 276 and then branch to the emergency/rephase key subroutine shown in the flowchart in fig. 13 and 14. There are two versions of the emergency/rephase key. One version, which will be referred to as the emergency key, is an opening version with a one in the opening bit position of the first character encoded on the key. The second version, referred to as the rephase key, is a non-opening key that has a zero in the opening bit of the first character. The emergency key will unlock the doors regardless of the status of the physical or logical locks. When the emergency key is inserted, the logic circuit is switched on, and if the door knob is turned, it will remain on. Because it is an opening key, the doorknob can be turned and if so it will release a logic relay. Turning the door knob also unlocks the physical lock. The logical lock cannot be removed by any other key than the emergency key.

The emergency/rephase key subroutine starts at block 450 which sets the logic line. The program proceeds to test block 452 which determines if the key is an unlock version. If it is not, the program branches to the rephase subroutine in fig. 14 which will be described afterwards. If the key is an opening version, the program proceeds to the emergency routine beginning at block 4 54 which recharges the solenoid. The program proceeds to block 456 which lights the yellow LED thus indicating that the solenoid has been charged to unlock the door, but the door knob has not been turned. The program proceeds to test block 4 58 which determines whether the cycle time has expired. If it is not, the program proceeds to the closing routine 234. If it has not exited, the program proceeds to block 4 60 which determines whether the door knob has been turned. If it is not, the program returns to block 458. If it has been rotated, the program proceeds to block 462 which frees the logical line. Then the program moves on to block 4 64 which causes the green LED to light three times. Then the program goes to the closing routine 234 and waits for the next key.

The emergency key is used to achieve a higher degree of security when locking a room. For example, if a guest has valuables in the room and wants to be sure that no key, including room keys, housekeeper's keys, etc. will be able to open the lock, the hotel management can use the emergency key and let the cycle time run out without turning the doorknob. This means that the logical relay is engaged and that it will remain engaged after the emergency key is withdrawn. In this state, no other key will be able to operate the unlocking mechanism. When the guest wants to return the locking operation, the emergency key is inserted by the management, and the door knob is turned to open the door. Thereby, the lock is moved to a stand-by position whereby it waits for the next key. The rephase key is used to transfer new lock codes into the lock at any desired storage level. The usual procedure is to insert the rephase key into the lock, then remove it and insert another key which is encoded with the key code to be read by the key code store. This is subsequently done in a similar way for a guest key that is used for the first time while the key's secondary code is written into the key code store at the level corresponding to this key.

The rephase subroutine will now be described with reference to fig. 14. It has already been stated that the emergency/rephase key program branches at block 452 when it is determined that the key is a non-opening version, i.e., a rephase key. The rephase subroutine starts with block 480 which determines whether it is the first time this key has been used. (When the rephase key has been used two consecutive times, the direct storage including the repetition counters 24 3 can be dumped via an output on the microcomputer to a laptop computer for analytical purposes. Then the program goes to block 482 which lights the yellow LED.) If this is the first time the key is used, the program proceeds to block 4 84 which increases the remaining cycle time by a factor of 4. The program then proceeds to block 488 which determines whether the current cycle time has expired. If the answer is yes, the program proceeds to block 49 0 which deletes the registration that the rephase key has been used. If the cycle has not expired, the program proceeds to block 492 which determines whether another key has been inserted. If not, the program returns to test block 488. If another key has been inserted, the program proceeds to block 494 which determines if the secondary codes are all unique. If the answer is yes, the program proceeds to test block 498 which will be described later. If the answer is no, the program proceeds to block 496 which determines whether the key code store is all unique. If the answer is yes, the program proceeds to block 498 which determines whether the emergency key was the last to open the door. If the answer is no, the program moves on to the closing routine 234. If the answer is yes, the program moves on to block 500 which transfers the new key code to the warehouse. If the answers to both test blocks 494 and 496 are no, the program proceeds directly to block 500 which transfers the new code to the store.

A second embodiment of the invention is shown in fig. 15 - 21. This second embodiment is characterized by a magnetic key which differs from the punched card described with reference to the first embodiment. As shown in fig. 15, the magnetic key 508 comprises a card 510, preferably of an opaque plastic material, which carries a magnetic tape or strip 512. The magnetic strip 512 in the form of a stereo recording tape, has two recording tracks 514 and 516. Each track is recorded with a waveform magnetic fields which, in analog signal form, constitute a sequence of magnetic poles. Each track is encoded with a magnetic signal comprising 20 bits of information. As will be described below, the magnetic key 508 is read by a key reader which converts the magnetic signals of the tracks 512 and 514 into electrical signals.

As in the first embodiment, the lock is arranged to use eight different key functions. But more than eight different types of key functions will be available even if only eight are programmed into the lock at one time. The following different types of keys can be programmed: Key type A: Normal operation for opening or non-opening and for subsequent and non-subsequent keys, for normal use or master key levels. All key types can operate in this range except for special types that will be described later.

Key type B: One-time central key. Allows only one doorway. Internal flag is placed in the warehouse to allow only one activation per strip code. Used for service personnel who only need to enter a room once.

Key type C: Normal guest use. The non-opening housekeeper key can be used to bar (lock out) the recently active guest levels. Internal flags are used to block up to four different guest levels. A subsequent card type must be the next card used to gain access to the room. When a new guest card is subsequently inserted into the lock, this guest level becomes active again, while the other guest level is still blocked. Use of a blocked guest card will only light a yellow LED.

Key type D: Housekeeping function. The opening version is operated as usual. The non-opening version will block all applicable guest level cards. Used to block a checked-out guest before a new guest card is issued. Up to four guest levels such as normal guests or suite are blocked at the same time.

Key type E: Room staff/low battery key. Normally used for access for room staff with a special effect for the blocking function in the event of a low battery condition. If the room staff key is used to open the door (i.e. the door handle) four different times at the same time with a low battery, the key must be inserted twice in succession to be able to unlock the door. The purpose is to alert the room staff that there is a need to replace the batteries. If the low battery lock function is in operation and the lock is rail locked, the first insertion of the room staff key will start the low battery indicator.

Key type F: Emergency/rephase. This is the highest security key that retains the logical relay status if the key is inserted and the door knob is not turned. The opening version is referred to as an emergency key and will always be able to open the door regardless of the physical and logical relay status. Inserting the key and turning the door knob will release the logic lock. The non-opening version of the key is referred to as the rephase key. Inserting this key will retain the logic bar but the door handle cannot be turned to release the logic bar. This key enables a new key code to be entered into the key code store. If the special storage level has been blocked by a code of only one, the emergency key must be used before the rephase key to transfer a new key code. The subsequent application of emergency key and rephasing key is also necessary to phase in a code of only ones at a level to block use of that level.

Key type G, security A: This key is the first of two key sequences for a high degree of security.

The opening version will retain the logical order while the non-opening version will not. This enables the introduction of a new security key without the use of a chain lock.

Key Type H, Security B: This key is the second in the two key sequences for high security. This key must be inserted within the normal cycle time after security key A to unlock the door. The opening version of this key will open the lock regardless of the latch status and will retain the logical latch status after application. The non-opening version can only follow a new key if needed and will not retain the key. Activating the door lock with security key A - security key B one after the other results in only security key B being recorded in the door lock history buffer.

Key type I, no operations: This non-opening key is used to program a level to an inactive level, ie to take that level out of use. No key is directly generated for this inactive level. The level can only be activated by power supply and reprogramming. No key will be able to operate at this locked level.

Key Type J, Hotel Pass: This is an auxiliary function that can be programmed to allow door lock activation only when there is a match between the card key level code and the hotel code, i.e. no match between the primary and secondary key codes is required. A typical application will be the guests' access to common hotel areas such as swimming pools, playrooms, etc.

As described above, the recorded code on the key is read from the key in two parallel data streams. For this purpose, a magnetic key reader is provided as schematically shown in fig. 16. The magnetic key reader comprises a pair of magnetic tape reading heads 522 and 524 which cooperate with recording tracks 514 and 516 on the key's magnetic stripes. The reading heads 522 and 524 conveniently constitute a conventional stereo pick-up or a reading head. The magnetic reading heads 522 and 524 are connected to a voltage divider 526 which is connected across the voltage source. The output of the reading head 522 is connected to the input of a differential amplifier 528 and the output of the amplifier is connected to the input of an analog-digital converter 53 2 . The output of the converter 532 is connected to a data contact pin DO on the microcomputer 112. Correspondingly, the output of the reading head 524 is connected to the input of a differential amplifier 534. The output of the amplifier is coupled to the input of an analog-to-digital converter 536 and the output thereof is coupled to an auxiliary clock contact pin and data contact pins D1, D2 and D3 of the microcomputer 112. As described with reference to Figures 2A and 2B, the key reader 38 includes a key switch 58 which actuated to the closed position with the key fully inserted and actuated to the open position when the key is withdrawn. thus, the data stream produced by the magnetic read heads 522 and 524 from the recording tracks 514 and 516 of the key is read into the microcomputer by the retraction movement of the key. The movement of the key causes a signal voltage to be induced in the read heads 522 and 524 in accordance with the recorded magnetic signals on the respective tracks 514 and 516. The signals are respectively amplified by the amplifier 528 and 534 to provide increased analog voltage signals. The analogue signals from the amplifiers 528 and 534 are processed by the analogue-to-digital converters 532 and 536, respectively, to produce corresponding digital signals. The output of converter 532 supplies a serial bit stream of twenty bits to the data contact pin DO corresponding to the data recorded on track 514. Similarly, the output of converter 53 6 supplies a serial bit stream of twenty bits to the microcomputer corresponding to the data recorded on tracks 516.

As described, the microcomputer 112 receives the code from the magnetic key in two parallel serial bit data streams of twenty bits per second. current. The microcomputer's read storage 215 includes a decoder operative under program control to reformat the input code stream for further processing of the key code. In particular, the decoder transfers the two serial bit streams into a storage format to be compared with the code stored in the key code storage 217. For the sake of understanding, one can say that the coded data read from the key is reformatted by the decoder so that it includes a control code field, a hotel code field, and primary and secondary key code fields. The control code comprises a four-bit character or layer of which three bits constitute the key level or function and the fourth bit the opening bit which defines the key as an opening key when it is a one and a non-opening key when it is zero. The hotel code includes a four-bit character to identify the hotel and to function as a hotel passcode which will be described later. The lock's primary key code comprises a sixteen-bit character and the lock's secondary key code comprises another sixteen-bit character. The stored key code arrangement can be considered equivalent to that described with reference to fig. 2C.

In this second embodiment of the invention, the microcomputer 112 and its connections with external circuits are the same as described with reference to FIG. 3A, 3B and 3C except that they are modified to accommodate the magnetic key reader 520 as described with reference to FIG. 16. Programming and operation of the microcomputer 112 is the same as previously described except as indicated in the following description.

This second embodiment of the lock using a magnetic key provides a higher degree of security compared to the first embodiment for several reasons. Firstly, the magnetic code on the key itself will not be easily examined. And it is difficult to reconstruct or copy. Second, the boot program requires a special sequence with several keys. In particular, when a lock is to be started up for the first time, at least 11 keys must be used in a particular order to open the lock. Third, a program key allows any level to be assigned to any function. Furthermore, a high degree of security is provided due to the code processing. In particular, the decoder that reformats the serial bit stream into a storage format is an internal part of the microcomputer data chips and is not accessible except through the microcomputer's inputs or pins. These features are in addition to those described with reference to the first embodiment, such as time-limited lockout after eight consecutive failed readings, and the necessity to actuate the key switch for each key and to turn the door knob within a time limit after finding the correct key code .

The start-up procedure for this second embodiment of the invention is shown in the flow charts in fig. 17A and 17B. The start-up procedure is characterized by the fact that it requires the insertion of a first and a second start-up key one after the other and also with the possible use of a program key as a device for assigning levels, i.e. to define or redefine the assigned levels in the key code repository. The operating system boot block 610 is operative to supply power to the microcomputer and the electronic control circuits. This power supply condition occurs by connecting the battery to the latch circuit and constitutes a cold start of the system. When power is applied, the program proceeds to test block 612 which determines if any part of the system is malfunctioning. If so, it returns to the start block 610, otherwise the program proceeds to an input block 614 and waits for the insertion of a key. When a key is inserted, the program proceeds to test block 616 which determines whether the inserted key is the first boot key. If it is not, the program returns to block 614 and waits for another key. If the inserted key was the start-up key, the program proceeds to input block 618 and waits for the insertion of another key. When a key is inserted, a test block 622 determines if it is the second power-up key. If it is not, the program returns to input block 614, if it was the second boot key, the program proceeds to input block 624 and waits for another key. When a key is inserted, test block 626 determines if it is the error/rephase key. If it is, the program proceeds to block 628 which sets up a fault condition overview, such as may be the same as that which was described with reference to the first embodiment of the invention. If the inserted key is not an error condition/rephase key, the program proceeds to determine if the inserted key is a valid programming key. The programming key is precoded with the key functions desired at various levels of the function table 219. If the programming key meets certain criteria, which are tested by the microcomputer, it is operative to set all eight levels of the function table and it dispenses the opening bit pattern in the four-bit control code. (As in the first embodiment, three of the four bits in the control code define one of the eight different levels, and the last bit tells whether it is an opening or non-opening key.) In the second embodiment, the opening bit can be placed in whichever preferably of the four bit positions. To determine if the inserted key is a valid one

programming key, as previously encoded, it is controlled by

a series of tests starting with test block 634. Test block 634 determines whether there is only a single one bit in the first column, i.e., in the four-bit control code so that when programming the latch as follows, only an open bit will be set . If test block 634 determines that there is more than one one bit in the first column, the program proceeds to block 628 which sets up an error condition table. If there is only one one bit, the program proceeds to test block 63 6 which determines if there is one and only one emergency key assignment in

the programming key. If there are none, or if there are more than one, the program proceeds to block 628 to set up the fault condition overview. If there is one or only one emergency key, the program proceeds to test block 638 which determines if there is at least one room staff key assigned. If it is not, an error condition table is set up at block 628. If it is, the program proceeds to test block 642 which determines whether at least one security key A or at least one security key B is assigned at the programming key. If the answer is no, the program proceeds to block 644. Block 644 is operative to assign new designs which will be described in what follows. If test block 642 determines that the programming key is assigned at least one security key A or security key B, the program then moves on to test block 64 6. This test block 64 6 determines whether security key A or security key B is specified in addition, i.e. to the other of the two. If it is not, the program proceeds to block 628 which sets up an error condition table. If a complementary part is found by block 64 6, the program proceeds to block 644 which assigns the new design, i.e. the key function for each of the eight different levels is established as pre-encoded on the programming key. The program then proceeds to input block 652 which waits for a key to be inserted. At this point in the procedure, the eight-character function table 219 is transmitted by block 644 to establish the desired layout of the eight key levels. It remains in the start-up procedure to load the key code store 217 with the key codes at the eight different levels corresponding to the eight different key functions assigned. For this purpose, the next key required in the boot sequence is the rephase key.

When a key is inserted at input block 652, the program proceeds to test block 654 which determines whether the inserted key is a rephase key with a level indication corresponding to the level assigned at the programming key. If it is not, the program returns to input block 652 and waits for another key. If it is, the program proceeds to block 65 6 which sets the logic line in response to the insertion of the rephase key. The program then proceeds to block 658 which assigns the hotel code by transferring the hotel code found on the rephase key into the lock's hotel code store. At input block 662, the system waits for a key to be inserted. At this point in the start-up procedure, the lock is prepared to receive assigned key codes that are transferred to the key code store 217 at a storage location designated by the same display used at the function table 226 in accordance with the assigned storage level. The phasing-in procedure for transferring key codes to the warehouse is completed by subsequent insertion of keys that have been programmed into the lock. This subsequent insertion of keys must be initiated with the key designated to the level just above the level of the rephase key. The subsequent insertion continues in numerical order for the key levels, and it must be understood that when level 7 is reached, the subsequent insertion continues from level zero. The subsequent insertion of this phasing is started at block 662 with the insertion of the key which has a level just above the level of the rephasing key. The program then proceeds to block 664, which constitutes the processing in the phasing sequence, where it is checked that the inserted key's level is correct. If it is not, the program will return to block 662. If the key is at the correct level, block 664 will have the secondary key code from the key transferred into the key code store 217 at a storage location or level that matches the key level codes encoded on the key. The program then moves on to the closing routine 234 and the system is transferred to the stand-by position. Next, test block 666 determines whether all key levels have been phased. If they are not, the program returns to block 6 62 and waits for another key to be inserted. When all levels are completed, the program proceeds to input block 668 and waits for the insertion of another key. At this point in the program, the lock will accept all keys and treat them according to its normal function except that the door cannot be opened because the logic latch is on. The emergency key is required to make the lock ready for door opening with the keys that have been assigned. The key is inserted at block 668 and the program proceeds to test block 672 to determine if it is an emergency key. If it is not, the program returns to input block 668 to wait for another key. If the answer is yes, the program proceeds to block 674, which releases the logic latch if the lock's door handle is turned. After block 674, the program proceeds to the lock routine 234 and the lock is moved to the stand-by position. The start-up procedure described above is usually carried out at the factory so that the lock is ready for use when it is installed on a door. But it can be performed after installation and the start-up procedure must be used when a lock has lost power, which can happen if the lock is tampered with or the battery has a short life.

After the start-up procedure as described above, with reference to fig. 17A and 17B, the lock is ready for use, and can be used by any of the eight different keys that have been phased into the lock. In response to a key inserted into the lock, the microcomputer controls the lock in accordance with the code read from the key. The microcomputer is operated under program control, and the program for all the keys that have been phased in is shown by the flowcharts in fig. 5, 6A and 6B as described above, but with the exceptions mentioned below. The program shown in the flowchart of fig. 5 is changed so that block 2 52 receives and stores ten characters during card withdrawal since there is an additional four bit character for the hotel code. Otherwise, the program is shown in fig. 5, the same as in the first embodiment of the invention. The program shown in fig. 6A differs from that of the first embodiment in that it is arranged to check the hotel code on each key. This change is shown on the flowchart in fig. 18 and will be described in what follows. As previously described, when the program reaches block 276 in FIG. 6B, branch to the subroutines at the level corresponding to the pointer detected at block 260. In this second embodiment, the same key function can be used as thus described in the first embodiment, i.e. the key function described with reference to the program subroutine shown by the flowcharts in fig. 7-14. This second embodiment also includes additional key functions of the type shown as security key A, security key B, hotel pass and non-operational (non-opening) key. These key functions and the corresponding program subroutines for performing the locking operations will now be described.

The program for the hotel pass function is shown on the flowchart in fig. 18. The program shown by the flowchart is part of the program shown by the flowchart in fig. 6A, in particular, the flowchart in FIG. 6A modified by introducing the card in fig. 18 between block 260 and block 261. After block 260, which uses the first characters indicating the control code to obtain a pointer or address for the key code's storage in the code store, the program proceeds to test block 704. Test block 704 determines whether the hotel code on the key is matched to the hotel code stored in the key code repository. If it is not, the program returns to block 282 (Fig. 6B) and waits for another key to be inserted. If the hotel code matches, the program proceeds to test block 706 which determines whether the key function as entered in the function table 219 is the hotel pass function. If it is not, the program proceeds to block 2 61 and is rejected as described earlier with reference to fig. 6A and 6B. If the key function is the hotel pass function, the program proceeds from block 706 to block 708 (regardless of whether the logic or physical relay is set) which charges the solenoid and allows the door to open. The program then proceeds to closing routine 234. As previously described, the hotel pass key can be useful for providing guests at the hotel

access to common areas such as swimming pools, playrooms etc.

The additional functions, namely non-opening key and security key A and security key B are arranged with subroutines in the same way as the various key functions in the first embodiment described with reference to the flowcharts in fig. 7-14. As described above, when the program in fig. 6B arrives at block 276, it branches to the subroutine for the level corresponding to the pointer indicated at block 216. The additional subroutines of the second exemplary embodiment will now be described.

If the key that was inserted at block 24 0 in fig. 5 was a non-opening key, the program would branch at block 276 of FIG. 6B to block 720 of FIG. 19.

The non-opening function is used to mark an unused level in the key code store and has the effect of programming a level to an inactive status. In normal operation, it would not be very useful to use a non-opening key because it would have no function, but it would be useful for security purposes to program one or more levels to non-opening functions. As previously described, all eight levels in the function table and the keystore must be assigned a particular function. Otherwise, the programming key is useless. Therefore, when the lock is programmed, and less than eight different active functions are desired, the remaining levels must be assigned non-opening functions. In the event that unauthorized access is attempted by a key that is found to be coded in accordance with the non-opening function, the computer program will respond by entering the error bar routine. When a non-opening function is assigned a selected level, that level in the key code store 217 is loaded with only ones. This has the effect of shutting down operations for this particular level. If a non-opening key is inserted into the lock, the microcomputer will operate under program control as described with reference to the flowcharts in fig. 5, 6, 6A and 6B. At block 276 in FIG. 6B, the program will branch to the subroutine for the non-opening function. This is shown by the flowchart in fig. 19. The program moves on to block 72 0 which processes the level code for the non-opening function and the program processes the error bar routine at block 282. Thus the system is brought into stand-by mode, and is inactive until another key is inserted.

For security reasons, the lock can be programmed to provide security key A and security key B's functions, as mentioned above. As described with reference to the start-up procedure, the functions of security key A and security key B must be used together. If only one is arranged in the programming key, the key will be useless and will not be able to be used effectively to create the program. If the functions of the security keys A and B are programmed into the lock, the security keys A and B can be used by authorized personnel to open the lock regardless of the logical and physical status of the rail. The keys must be inserted in a specific order, A first and then, within a predetermined time interval, B must be inserted. This will unlock the door, and the lock will be left in a status with the logical correct applied.

(But the warehouse will have recorded security key B as the last key that opened the door.)

Application of the lock with the security keys A and B and the control programs for these subroutines will now be described with reference to the flowcharts in fig. 20 and 21. If the key inserted at block 24 0 in fig. 5 is a security key A, the program will branch at block 276 in FIG. 6B to block 730 of FIG. 20. Fig. 20 constitutes the program or subroutine for security key A. Block 730 sets the logic line and the program proceeds to block 732 which lights the yellow LED indicating that the key is accepted. The program then proceeds to test block 734 which determines whether the five second time has expired. If it is, the program proceeds to block 736, which erases the security key A's incoming signals from the last key used storage. The program then proceeds to the closing routine at block 234. If the time at test block 734 has not expired, the program proceeds to test block 738 which determines whether a new key has been inserted. If not, the program returns to block 734. If a new key has been inserted, the program returns to block 24 0 and processes the new key. When the new key has been processed, the program will be executed in accordance with the purpose of the key type, but with the restriction that the logical line was set by the security key A. Thus, if the new key e.g. is a room staff key, access will not be granted to open the door because the logic latch is set. Furthermore, introducing another key will have the effect of deleting the security key A's registration from the memory of the last used key. If no new key is entered before the time expires, which is determined at block 734, the program will continue to block 736 which deletes the security key A input signal as described above.

If a new key is entered within the five second time interval, as determined at test block 738, and it is a security key B, the program will proceed from block 240 of FIG.

5 to block 276 in FIG. 6B. The program will then branch to the security key B subroutine in fig. 21. In this subroutine, block 750 asserts the logic line and the program proceeds to test block 752. This test block determines whether the last key inserted was security key A. If it was not, the program proceeds (after lighting it yellow LED) to the closing routines at block 234. If the last key was security key A, the program proceeds to block 754 which charges the solenoid if security key B is an opening key. The program then proceeds to block 756 which lights the green LED to signal opening. The program then proceeds to test block 758 which determines whether the time has expired. If it has, the program proceeds to the closing routine at block 234. If it has not, it proceeds to test block 7 62 which determines whether the door knob has been turned. If not, the program returns to test block 758. If the door knob has been turned, the program proceeds to the closing routine at block 234.

The third embodiment of the invention is shown in fig. 23 - 31. This third embodiment uses the magnetic key as in the second embodiment. It is characterized by a linked code on the key, direct programming of the lock, application with a 40-bit or 60-bit code on the key card and additional application functions and a secret time recording for door opening.

In the second embodiment, the lock is arranged to use eight different key functions. But more than eight different types of key functions are available even if only eight are programmed into the lock at any given time. In addition to key functions described with reference to the second embodiment, the following additional types of keys can be programmed: Key type K, office door deadbolt function: When office hardware is provided, this function will operate the solenoid and deadbolt parts to move the hardware to the locked position. The yellow LED lights up during the ice making sequence. If office fittings are not included, this function will be an additional function.

Key type L, non-iced office lock function: When the office hardware is provided and the hardware does not indicate an already non-iced status, this function will operate the solenoid and locking parts so that the hardware remains uniced. The green LED lights up during the non-iced sequence. If the fitting is not already covered with ice, the green LED only lights up for a period. If office fittings are not included, this function will act as an additional function.

Key type M, office door tilt function: When office fittings are included, this function will be used as either an office door locking function or an office door non-locking function, depending on the status of the fittings' limit sensors. If office fittings are not included, this function will be an additional function.

Key Type N, Security Key C: This function ignores the logical key but not the physical key. An additional program code is available to use this function to bypass both the logical line and the physical line. This is a simple key card sequence that differs from the security keys A and B's functions described above.

Key type 0, low lock toggle: This function locks out all levels lower than the level of this function. When this function is executed, other levels that are numerically lower on the function assignment table are inhibited. The red LED is used to indicate when the blocking status is set and thus uses a low battery indication.

Key type P, high locking rocker: This function locks out levels higher than the level of this function. When this function is executed, other levels that are numerically higher on the function assignment table are inhibited. The red LED is used to indicate when the blocking status is set and thus uses the low battery indication.

Key type Q, redefinition (reprogramming) key: This key has four-bit drive mode characters instead of the hotel code characters. The redefinition key is used for direct programming of the lock.

Key type R, allocation key: This key is used for transfer allocation of hotel code and driving mode.

As will be described in detail below, the function assignment can be changed with the lock in use and in operational condition, i.e. by direct programming. This is done with the redefinition key card. Apart from the fact that the key card meets different qualification tests, no changes have been made to the function assignments. It does not make it possible to change the emergency key level assignment or the opening bit assignment.

In addition to the above features, the third embodiment provides a time-based representation of the door opening history, i.e. a secret time record of the door openings. Additional parts are arranged so that the lock opening chronology can be carried back for a period of several days. The circuitry required to provide this time base is shown in Fig. 23. The microcomputer lock control circuit in the third embodiment is substantially the same as that described above with reference to fig. 3A with changes described with reference to fig. 23. As shown in fig. 23, an external clock is coupled to the microcomputer 112. A clock 820 comprises an oscillator with an external frequency determining circuit 822 and it also comprises a character counter which constitutes a binary dividing function. The clock 820 provides a positive going pulse, an output signal 824 at a rate of one pulse per second. minute.

This output signal 824 is coupled directly to microcomputer 112's SI input pin and SE input pin. The output signal 824 is also coupled directly through a control diode 826 to the microcomputer's input start signal contact pin. The reset output signals from the microcomputer contact pins are coupled via a resistive-capacitive network 828 to the clock 820 reset input signal. The start switch 58 is connected directly to the IRQ input signal contact pin and it is connected via a control diode 832 to the input signal of the microcomputer contact pin.

Typically, the real-time clock 820 is used in conjunction with the microcomputer 112 to provide a time-based record of the lock's openings in the history buffer. For this purpose, the time signal is registered at specific intervals, e.g. every four minutes. When a pulse from the clock is emitted as an output signal 824 from clock 820, it is passed on to the start input contact pin via diode 826 and the microcomputer is switched from standby mode to operating mode. The pulse from the clock is also passed on to the SI and SC input contact pins. The SC input contact pin causes the serial buffer flag to be set on receipt of every fourth pulse, as will be described below. The SI input causes the microcomputer to send a reset pulse from the reset output signal contact pin to the reset input of the clock 820. This reset pulse effectively resets the hour counter so that it starts counting again for the next minute in the clock output signal. At the same time, the clock's output 824 goes down and the microcomputer 112 is transferred to the stand-by position. A start signal for the microcomputer generated by the insertion of a key is given priority over a start signal generated by the clock 820. For this purpose, the logic high signal, which is a signal produced by closing the key switch 58, is fed to the start input contact pin via diode 832 and similarly, it is applied to the IRQ pin as an interrupted, delayed signal that gives the key switch priority over the signal from the clock. This means that if a key is inserted at the interval for a pulse from the clock, the key will be processed as usual, while the pulse from the clock, during the processing of key data, will be withheld and the clock will not be reset until after completion of the key data processing. After the reset pulse, the microcomputer will return to stand-by mode.

To complete the office lock function in the third embodiment, the microcomputer 112 is provided with additional contact pin connections as indicated below. Contact pin A is switched down via a switch 852 to indicate that it is used in conjunction with the office lock. A snap lock detector 854 that goes up when the lock is in the locked position is connected to contact pin B.

A non-icing detector 85 6 is connected to an input contact pin C and goes up when the lock is in the non-icing position. In addition, four output contact pins are arranged to regulate the charging of actuators in the office mortise locks. These output contact pins are the non-icing signal contact pins ULS , the non-icing holder contact pins ULH, the ice-icing signal contact pins LS and the ice-icing holder contact pins LH. These output pins, used in conjunction with the output signal contact pins 04 and 0.5 previously described, function as the lock/unlock output signals and control the charging of the solenoid 66 in both a retracted mode and a latched mode. When the ULS contact pin is traversed, the ULH contact pin is simultaneously traversed to a starting movement. The non-icing signal at the contact pin ULS is of short duration and after it is gone, the non-icing hold signal at the contact pin ULH is held back for a predetermined time interval to allow the non-icing position to be achieved. When the LS contact pin is reviewed, the LH contact pin is similarly reviewed at the same time. The icing pulse signal is a pulse of short duration and after decaying, the icing hold signal at the LH contact pin remains for a predetermined time interval to allow the icing status to be achieved. The office door deadbolt with ice-covered and non-ice-covered operating units can be designed in a number of ways. E.g. the lock can be of the type described with reference to fig. 2A and 2B which are used in conjunction with a locking pin (such as a locking pin 64) and a non-icing pin to hold the locking pin in the non-icing state, i.e., unlocked state, and an icing pin to hold the locking pin in an iced position. The unlatched pin is biased to break contact with the latch pin of an unlatched solenoid and is biased into engagement with the latch pin by a return spring. similarly, the latch is provided with a detent pin which is actuated to break the detent pin's contact with the detent solenoid and is actuated to engage the detent pin by a return spring. Such an arrangement means that the locking pin is held in either an inserted (locked) or retracted (unlocked) position, i.e. in a locked or unlocked position, without energy input from solenoids or other actuators. Thus, the actuators will draw no current from the battery except when the lock is actuated to change its position between the locked and unlocked positions. It will be appreciated that other mechanisms which provide a locked and unlocked position can be used such as a motor-driven screw actuated locking pin which is manually held in either a locked or unlocked position without the supply of energy from an actuator. Thus, contact pins 04 and 05 as well as contact pins ULS, ULH, LS and LH will be used in accordance with the special mechanism for locking and unlocking the office door.

Furthermore, according to the features of the third embodiment, the direct storage of the microcomputer 112 is equipped with additional registers as shown in fig. 24. For use in conjunction with the time location provided by clock 820, the direct storage includes a serial buffer flag 838, a three-digit digital counter 842, and a history buffer 844. The direct storage also includes a high cell register 845, a low cell register 847, a two-part code register 849, and a redefine flag 848. The application of these registers and flags will be described in detail later. The direct storage also includes a run mode register 84 6 which contains the four-bit character initially allocated for the redefine key when used for function allocation, as described above. The drive mode register's four bits are as indicated below. Bit zero determines the low battery condition. When the bit is lva, the room staff key functions as described above, i.e. after four low battery key insertions, the key must be inserted twice in sequence to open the door. When the zero bit is high, the key will not open the door until the battery condition is corrected. Bit zero is called

the "unlock bit". The drive mode character's bit one determines the security C function's security limit and confirmation of fully read key cards containing erroneous data. Bit one is referred to as the "C-bolt". When the bit is low, incorrect data is acknowledged with a single pulse to the yellow LED except when the previous number of incorrect key entries has put the lock in guard mode, as described above, where the full cycle time has been transmitted and further key entries will have no effect. Also when this bit is low, a lower level of security is provided in the security key C function by the logical line being ignored when the physical line is in operation. When bit one is high, a higher level of security is provided by rejected keys giving no signal back to the operator, i.e. no LED singal, and further, the security key C function acts in the same way as the emergency key except that opening the door does not release it logically correct. Bit two of the drive mode characters, designated as the "code 64-bit", determines the data format of the binary keys but does not change the punched data card formats. When this bit is low, key data is interpreted in the same manner as for the 40-bit code described with reference to Embodiment No. 2. When this bit is high, the 64-bit format in the third embodiment is obtained. Bit three of the drive mode characters determines

the extent and distribution of lock access history. It is designated as the "RTC bit". When this bit is low, the lock store for the recognition code is allocated,

the repeat entry counter and duplicate identification numbers that match numbers for the last fifteen entries. When this bit is high, the entire history is reduced from fifteen to eight times, and all accesses have a three-digit character counter that reads according to the time of last access for a matching key.

The features and operation of the third embodiment will now be described with reference to the flowcharts in fig. 25 - 31. The start-up procedure for the third embodiment is the same as for the second embodiment which was described with reference to the flowcharts in fig. 17A and 17B. After the start-up procedure, the lock is ready for use and can be used with any of the keys that have been phased into the lock. In response to each key inserted into the lock, the microcomputer controls the lock in accordance with the code read from the key. The program management for all the keys that have been phased in is shown on the flowcharts in fig. 5, 6A and 6B as described with reference to the second embodiment and with the exceptions mentioned below. The program shown on the flowchart according to fig. 5 is modified so that block 252 receives and stores sixteen characters upon key retraction when bit 2 (64-bit code) of the run mode character is high. This enables 64-bit format. If the 64-bit code is low, the 40-bit format and the program according to fig. 5 remains unchanged. The program shown by the flowcharts in fig. 6A and 6B, in this third embodiment, are modified as described below.

In order to enable a new key to perform its function if the primary code is not adapted to the key code of the previous key, devices are provided to make the key valid with another code in the warehouse. In the second embodiment, as described with reference to fig. 6A and 6B, contains a new key, which is a guest key, a primary code and a secondary code. The secondary code is the new code for this particular key which, after the first use, must be stored in the lock's key code memory to enable the key to open the lock. The primary code on the key is the key code that was assigned to the previously assigned key, i.e. the previous guest. In the second embodiment, as described with reference to fig. 6A and 6B, a new key used for the first time will open the lock if the primary code is adapted to the code previously stored in the key code memory of the previous key. But, if e.g. the guest key, assigned to the previous guest for a given room was never inserted into the lock, the key code stored in the key code memory will remain the same as that transmitted when the last key used in the lock was inserted. Thus, it is possible in the second embodiment that a newly assigned key will be inoperative because neither the primary code nor the secondary code will be matched to the code stored in the key code memory. The likelihood of this is reduced by providing an appropriate link code on each newly assigned key in addition to the primary code. The link code is the new key code of a key that was assigned before the key from which the primary code is derived. Preferably, the link code is that of the next after the last assigned key. These link code features are available only when the run mode character's 64-bit code is high, indicating that the 64-bit format is available. Use of the lock with the link code features will now be described with reference to fig. 25A and 25B.

The program shown by the flowcharts in fig. 25A and 25B correspond to what is shown by the flow charts in fig. 6A and 6B, but differs in that it provides the possibility of using a link code on the key. This program in fig. 23A and 23B are used when operating the lock with different keys that have been phased in at different levels in the key code store. As described with reference to fig. 5, upon obtaining a valid key data read, the program proceeds from block 257 of FIG. 5 to block 260 in FIG. 25A. (When a program block in Figs. 25A and 25B is the same as a program step in Figs. 6A and 6B, the same reference characters are used.) The program step of block 2 60 uses the first character, which represents the level code, together with table 219 in the warehouse to obtain a pointer or address of the stored key code storage location in the key code store 217. Next, a test block 2 60A determines whether the key's secondary code is matched to the code stored in the key code store and that the last code is not equal to one. If it is, the program proceeds to block 274 which frees the error counter and then the program proceeds to block 27 6. At this point, the program branches to the subroutine for the level corresponding to the pointer. If the answer is no at test block 2 60A, the program proceeds to test block 261 which determines whether the last key was the rephase key. If it was, the program moves on to test block 2 64 which determines whether the key's primary code is adapted to the code stored in the key code store. If the answer is yes, the program proceeds to test block 2 64. If the answer is no, the program proceeds to test block 2 62A which determines whether the key's linked code is adapted to the key code stored in the key code store. If it is not, the program proceeds to test block 282 which increments the error counter 239. Then test block 284 determines whether the error counter is greater than eight. If it is not, the program proceeds to the closing routine 234 which causes the system to go to stand-by position and wait for the next key. If the error counter is greater than eight, block 288 sets a time delay in status control 223 of five seconds to prevent reading data from a key at block 252 in FIG. 5 until five seconds have elapsed.

If at test block 2 62 it is determined that the key's link code is equal to the code stored in the key code store, the program proceeds to test block 2 64. From this point the program shown at blocks 264, 266, 278, 280, 234, 268, 270, 274 and 276 the same as what was previously described with reference to fig. 6a and 6B. The program can be summarized by reference to the link code features that follow. If the key's secondary code is adapted to the key code store and not all are unique, the program proceeds to the subroutine for the level that corresponds to that key. If it is not, but the key's primary code is adapted to the key code store, the secondary code will be transferred to the key code store, the "new" flag is set and the program proceeds to the subroutine for the key's level. If the primary code is not adapted to the warehouse but the link code is adapted to the warehouse, the same result is achieved as when the primary code is adapted to the warehouse. If none of the key's codes are matched to the storage, the error counter is increased, and the lock is taken to the locking routine.

When the program reaches block 27 6 in fig. 25B, it branches to the subroutine for the level corresponding to the pointer obtained at block 2 60. In this third embodiment, the same key function as that described in the second embodiment may be used. For the key functions described with reference to the second embodiment, the subroutines remain the same for this third embodiment except for the following: The subroutine in FIG. 9 is changed by omitting blocks 370, 374, 376, 372 and 234 and at this point replaces the subroutine of FIG. 29. The subroutine according to fig. 10 is changed by omitting the blocks 392, 396, 398 and 234 and is replaced by the subroutine in fig. 29. The subroutine in fig. 11 is changed by omitting the blocks 414, 416, 412, 418 and 234 and replaced by the subroutine according to fig. 29. The subroutine in fig. 18 is changed by omitting blocks 708 and 234 and replaced by the subroutines in fig. 29.

This third embodiment also includes additional key functions or types referred to herein as office door latch, non-slatted office lock, office latch lock, security key C, low door latch and high door latch, as described above. It also includes various subroutines for the various key functions. These additional key functions and corresponding program subroutines for performing the locking operation will now be described.

The office key function is provided for the operation of locks of the type that are usually used on office doors, such locks have a bolt that is either snapped shut or not, i.e. the bolt is held in the inserted position or in the retracted position for a locked or unlocked position, respectively. To provide the capability for office functions, the microcomputer 112 has a pin A which is connected via a switch 852 to indicate that it is used in conjunction with an office lock. In addition, it has a pin B which is connected to a latch detector 854 which is scanned when the latch is in the latched position. It also has a pin C coupled to a non-icing detector 856 which is scanned when the lock is in the non-icing position. In the office lock, the deadbolt key is operative to charge the solenoid and the deadbolt ports to place the bolt in the locked position. The non-icing key is operative, when the lock is not already in the unlocked position, to charge the solenoid and the latch ports to move the lock to the non-icing position. The toggle key is operative to open the snap lock if it has been snapped shut, and to snap it again if it has been unlocked.

The program for the office functions is shown by the flowcharts in fig. 2 6A and 2 6B. If the key that was inserted at block 24 0 in fig. 5 was a snap lock key, non-icing key, or toggle key, the program would branch at block 276 of FIG. 25B to block 860 in FIG. 26A. The test block 860 determines whether the logic relay is set. If it is, the program proceeds to block 862 which lights the yellow LED and the program proceeds to the closing routine 234. If the logical relay is not set, the program proceeds to test block 864 which determines whether the physical relay is set. If it is, the yellow LED lights up, but block 862 in the program goes to the lock routine 234. If the physical latch is not set, the program moves on to test block 866 which determines whether the lock is an office lock, i.e. whether pin A of the office fitting is logical low. If it is not, the solenoid is charged at block 868 and the program proceeds to the lock routine 234. If the lock is an office lock, the program proceeds to test block 870 which determines whether the key is a non-icing key. If it is, test block 872 determines whether the lock is unlocked. If it is, block 874 lights the green LED. If resisted, the program proceeds to block 87 6 which sets the non-icing pin to charge the non-icing actuator to the non-icing position.

If test block 870 determines that the key is not the non-iced key, test block 878 determines whether the lock is in the iced position. If it is, block 882 lights the yellow LED. Otherwise, block 884 sets the icing pins to charge the icing actuator to the icing position.

If test block 878 determines that the key is not the ice wrench, the program proceeds to test block 886 which determines whether the key is a toggle wrench. If it is, block 888 determines whether the lock is non-iced. If it is, the program proceeds to block 884 which charges the solenoid to the ice-covered position. If it is not non-iced, i.e. if it is iced, the program proceeds to block 890 which sets the iced pins to charge

the lift-up actuator to the lift-up position.

If test block 886 determines that the key is not the rocker switch, the program proceeds to test block 892 which determines whether it is the emergency key. If it is, block 894 charges the solenoid to the non-icing position and the program proceeds to block 89 6. Block 896 charges the solenoid to the icing condition. Next, block 898 leaves the logic line in if the doorknob is not turned and lets it go out if the doorknob is turned.

If test block 892 determines that the key is not the emergency key, the program proceeds to test block 902 which determines whether the lock is non-iced. If it is, block 904 lights the green LED. If it is not, block 906 loads the office door non-icing lock. The program then proceeds to test block 9 08 which determines whether the door twister has been turned. If it is not, test block 910 determines whether the five-second time has expired. If it is not, the program returns to test block 9 08. If the time has expired, the program proceeds to block 912, which recharges the office latch.

For security purposes, the lock can be programmed to provide the security key C function, as mentioned above. In the second embodiment, the security key A and security key B functions were provided as previously described. Security keys A and B can be used by authorized personnel to open the lock regardless of the status of the logical and physical key. The keys must be inserted in a specific order and within predetermined time intervals between the insertions, as described above. This will unlock the door and the lock will be left with a status where the logic latch is set.

In this third embodiment, the security key C function is provided to provide a lower level of security than that of security keys A and B and to provide the operation with a single key. The security key C function has the ability to ignore the logical key but not the physical key in its lower security mode. Furthermore, by turning on the C bolt bit in the drive mode character, the security key C function is operative to be passed over the logical rail and past the physical rail.

Operation of the lock with security key C and the control program for this subroutine will now be described with reference to the flowchart in fig. 27. If the key inserted at block 240 in fig. 5 is a security key C, the program will branch at block 276 in FIG. 25B to test block 920 in FIG. 27. Test block 920 determines whether the key is an opening key. If it is not, block 922 lights the yellow LED. If it is, the program proceeds to test block 923 to see if the logic rail is set, and regardless of the answer, the program proceeds to test block 924 which determines whether the C-bolt bit in the drive mode character is logic high. If it is not, test block 926 determines whether the physical relay is set. If it is, block 922 lights the yellow LED. If the physical rail is not set, the program proceeds to a test block 928. If test block 924 determines that the C-bolt bit is logic high, the program will bypass the physical rail bolt test block 926 and proceed to test block 932 after only setting it logic at block 93 0. Then block 934 turns on the green LED. The program then proceeds to test block 936 to determine if the five second time has expired. If it is, the program continues to bar routine block 234. Otherwise, test block 938 determines whether the door handle has been turned. If it is not, the program returns to test block 936. If it is, the program proceeds to the closing routine at block 234.

For administrative or security purposes, the lock can be programmed to provide the high lock or low lock functions. E.g. the hotel manager can choose to make various key functions inoperative for a limited period of time. To this end, a high lock key and a subroutine are provided to temporarily lock out or render inoperative all key functions (except the security functions) at a higher level than the level of the top lock key. Similarly, a low lock key and subroutine is provided to lock out keys (except security keys) at a level below that of this low lock key. After each key has been used to achieve the low-lock function, the shutdown function is canceled by inserting this key again and thus all levels of operability are restored.

Operation of the lock with high lock and low lock keys and the control programs for these subroutines will be described with reference to the flowcharts in fig. 28A, 28B and 28C. If the key inserted at block 24 0 in fig. 5 is a high lock key, the program will branch at block 276 in FIG. 25B to block 950 in FIG. 28A. Block 950 frees the red LED so that it is available to indicate the shutdown condition (during shutdown, the red LED is not available for low battery condition indication). The program proceeds to block 952 which reads the level number stored in the high cell register in the direct storage. Next, test block 954 determines whether the level number stored in the high cell register 845 is equal to the key function position, i.e. the level number of the high lock key in the register 219. If it is not, block 956 stores the key function position in the high cell register. Then block 958 turns on the red LED and the program proceeds to test block 960. If test block 954 determines that the level number in the high cell register is equal to the key function position, this indicates that the high lock key is inserted to cancel the high lock function. Block 962 then only stores ones in the high cell register. This ensures that all level numbers in the high cell will be greater than any key level and therefore none of the key levels are excluded. The program then proceeds to block 9 70 to the various subroutines in fig. 29 which will be described in what follows. In short, the various subroutines test whether the relevant level is blocked by a high lock or a low lock. If it is, the program proceeds to the closing routine, if not, the solenoid is charged.

The subroutine of the low lock key is shown by the flowchart in fig. 28B. It is the same as for the high lock key except as stated below and for the sake of simplicity the full description will not be repeated. It should be noted that the same reference characters are used in fig. 28B as in 28A for matching blocks, except that an apostrophe is added to the reference character in FIG. 28B. The difference between the low latch subroutine and the high latch subroutine is as follows: Block 952' reads the level number stored in the low cell register in the direct storage. Next, test block 954' determines whether the level number stored in the low-cell register 847 is equal to that of the key functions' position, i.e. the low-lock key's level number in register 217. If it is not, block 956<*>stores the key's function position in the low-cell register. Then block 9 58' turns on the red LED and the program moves on to test block 960<*>. If test block 954' determines that the level number in the low cell register is equal to the key function position, this indicates that the low lock key has been reinserted to cancel the low lock function. Block 962' then stores all zeros in the low cell register. This ensures that the level number in the low cell will be less than all key level numbers and consequently none of the keys are banned. From this point, the program proceeds to block 970 and is identical to that of FIG. 28A.

When the high lock or low lock key functions are used in a system as described above, all keys are processed in accordance with the subroutines in fig. 29. (This subroutine is a new, different subroutine for this third embodiment due to the high lock and low lock functions.) When a key is inserted at block 240 of FIG. 5, the program will branch at block 276 in FIG. 25B to block 979 in FIG. 28C. Block 970 determines if the key's key function position is less than the level number stored in the low cell register 84 7. If it is, the program branches to block 972 which lights the yellow LED, then the program proceeds to bar routing 234. If test block 970 determines that the key function position is not less than the level number in the low cell register, the program proceeds to test block 974 which determines whether the key function position is higher than the level number stored in the high cell register 845. If it is, the program branches to block 972 to light the yellow LED and then proceeds to the shutdown routines 234. If it if it is not, the program proceeds to test block 976 which determines whether the logic line is set. If it is, the program lights the yellow LED and continues to the shutdown routine 234. If it is not, test block 978 determines whether the physical relay is set. If it is, the yellow LED is lit at block 972 and the program proceeds to the closing routine 234. If it is not, block 980 charges the solenoid and then the program proceeds to the closing routine 234. Thus, the subroutine in fig. 28C operative to lock out in accordance with either the high lock or low lock function keys. As described above, normal operation is restored so that no keys are locked out upon reintroduction of either the high lock or low lock key, as the case may be.

As described earlier, the second embodiment of the invention has special features for programming the key functions. This allows the assignment of any key function to any desired level of the key code repository. The start-up procedure as described earlier with reference to Figures 17A and 17b is characterized by requiring a first and a second start-up key to be inserted one after the other and also by the further use of a programming key as a device for assigning levels, i.e. for defining or redefine assigned levels in the keystore. This start-up procedure also allows the assignment of hotel code in the keystore. These programming features are very beneficial in that they allow flexibility in assigning levels and hotel codes in different installations and it also allows changing the assigned level and hotel code in a given installation. But it is a disadvantage of the second embodiment that changes cannot be made without turning off the lock, i.e. removing the power supply, and going through the entire start-up procedure. This third embodiment overcomes the above drawback and provides direct programming to produce various changes. For this purpose, devices are provided to assign special functions and carry out selected changes. The selected changes are reprogramming assigned new functions for different levels in accordance with a programming key or reassigning the drive mode character bits and the hotel code to an assigned key.

Direct programming of this third embodiment can be started at any time after the lock has been phased in, as described with reference to fig. 17A and 17B. The direct programming subroutine will now be described with reference to Figures 3OA, 3OB and 30C. In general, the direct programming subroutines that will be described require the code sequence of two different keys followed by an inserted redefine key. The first key is an initial boot key that has no function other than boot, the second key is an emergency level key (either emergency key or rephase key) and the reset key can be either a programming key or a reassignment key.

Reference should now be made to fig. 3OA, where the direct programming subroutine starts with the insertion of a key at block 1000. The test block 1002 determines whether the inserted key is the first boot key. If it is not, the program proceeds to block 260 with the subroutines according to fig. 25A and 25B, to process key data as previously described. If the first is the boot key, the program proceeds to block 1004 which lights the yellow LED and then to block 1006 which sets the time unit to twenty seconds. Next, test block 1008 determines whether the time unit has expired when another key is inserted, and if so, the program goes to the closing routine 234. If it has not expired, the program proceeds to test block 1010, which determines whether another key has been inserted. If that is not the case, the program proceeds to block 1008. If another key is inserted, the program proceeds to 1012 which determines whether the inserted key is an emergency level key. If it is not, the program proceeds to block 260 in the subroutine according to fig. 25A and 25B to process key data. If it is the emergency level key, the program proceeds to block 1014 which lights the yellow LED and then to block 1016 which resets the time unit to 20 seconds. Next, block 1018 sets the "redefine" flag 848 if the emergency level key is an opening key. The program then proceeds to test block 1020 which determines whether the time unit has expired. If it is, the program goes to the closing routine 234. If it is not, the test block 1022 determines whether another key has been inserted before the time unit has expired. If it is not, the program returns to block 1020. If it is, the program proceeds to test block 1024 which determines whether the redefine flag is set. The third key, namely the key inserted at test block 1022 will be checked to determine if it is a redefine key. If the redefine flag is set, as determined at test block 1024, the third key will be treated as a programming key, otherwise it will be treated as an assignment key allowing reassignment of the drive mode and hotel code characters. If the flag is set, the program continues from test block 1024 to test block 1026 which determines if there is only a single one bit in the first character. If not, the key does not qualify as a programming key and the program proceeds to block 260 of the subroutine of FIG. 25A and 2 5B. If it has only a single one bit in the first character, it qualifies as a programming key, and the program proceeds to block 1028 which cancels the relevant opening bit and the emergency code in the storage thus ensures that there will be no changes in these codes. The program then proceeds to test block 1030 which determines whether the key satisfies the criteria for a programming key as previously described with reference to fig. 17a and 17B. If it does not satisfy these criteria, the program proceeds to block 260 in FIG. 25A. If it does, the program proceeds to block 1032 which assigns new functions to various levels in accordance with the code on the programming key. Then block 1033 lights the yellow LED and the program goes to the closing routine 234.

If test block 1024 determines that the redefine flag was not set, the program proceeds to test block 1034 which determines if there are no ones bits in the first character. If not, the program proceeds to closing routine 234. If there are no ones bits in the first character, test block 1036 determines whether the key contains five characters that are the same as the first boot key for further confirmation that the key meets the requirements for an assignment key . If it does not, the program proceeds to the closing routine 234. If it does, block 1038 stores the newly entered drive mode characters in register 84 6. Next, block 1040 stores the newly entered hotel code in the hotel code register 849. Then the program proceeds to block 1042 which lights the yellow LED to indicate they are accepted.

As described above, in the third embodiment, a time-based recording of the last eight entrances or door openings is provided. Information regarding the last eight openings is recorded in the history buffer 241. When the RTC bit in the drive mode character is set high, the microcomputer drives the real-time clock 820 to record data regarding each door opening in the history buffer. In particular, the recognition code (management code) of the last key is registered. If there is a new entry with the same key, the clean entry counter is increased. If the key has the same recognition code, but a different ID code, the ID code is registered in the buffer. Operation of the microcomputer with the real-time clock 820 and the three-digit digital RTC counter will be described with reference to the flowchart of FIG. 31. The program shown by the flowchart is started when the microcomputer's start contact pins go high as indicated at block 1050. Next, test block 1052 determines whether the high input signal was produced by the key switch 58. If so, the program proceeds to flowchart block 260 in FIG. 25A to process key data. If it was not the key switch, the program proceeds to test block 1054 which determines whether the high input signal was provided by the timer 820 at input signal 824. If it was not, the program proceeds to the latch routine 234. If it was, test block 256 determines whether the input pin SI is high. If it is, block 1058 sends a reset signal from the reset pulse on the microcomputer to the reset contact pin of clock 820. If pin SI is not high, the program proceeds to test block 1060 which determines whether serial buffer flag 838 is on, i.e., serial buffers containing four counters are full. If it is not, the program proceeds to block routine 234. If it is, the program proceeds to block 1062 which increments the three-digit digitalRTC counter. The program then goes to the closing routine 234.

Claims (5)

1. Lock system comprising: a lock (10) comprising a locking device (14) for setting the lock in a locked or unlocked position, a microcomputer (112) including a read memory (215) and a read/write memory (RAM 217-245), a number of keys (34,508) of different types, where each key has a control code (102), including a stored key code (104,106) where each key type has a different locking function identified by the control code (102), where read/write storage (217-245) comprises a key code store (217) with the predetermined number of assigned key codes stored therein, and wherein the read store (215) comprises a program store (800) for program control of the microcomputer (112), a key reader (38) coupled to the microcomputer (112) is arranged to cooperate with any of the selected keys (34) to read the control code (102) as well as the key code (104,106) stored thereon, into the microcomputer (112), and an electrically controlled actuator (42) for the locking device (14) which is connected to that of the microcomputer (112) unlocking signal, characterized in that the program storage (800) comprises a main program and a number of subroutines which are each stored in different storage locations in the read storage (215), that the read/write storage (217-245) comprises a control code register (806) and a function table (219 ) with a number of pointers that each point to one of the subroutines' storage address in the program storage (800), and where the number of pointers in the function table (219) is equal to the number of storage locations in the key code storage (217), that a decoding device (802) is operative during program control in connection with the control code (102) from the key (34) for the pointers to a selected storage location in the key code storage (217) and to a selected storage location in the function table (219) corresponding to the control code (102), that the microcomputer (112) is operative under program control of the main program as a function of the input code signal from the key reader (38) from a selected key (34) to store the control code (102) in the control code register (806) and to compare the key code (104,106) from the selected key (34) with the assigned key code at the storage location in the key code storage (217) selected by the decoding device (802), and if there is a match between these, the microcomputer (112) becomes operational under program control of the subroutine in the program storage (800) at the designated storage address of the function table (219) storage address selected by a decoding device (804), and that the read storage (215) stores a greater number of subroutines than the number of storage locations in the function table (219), after which the locking system is operative in accordance with the locking function of the selected key (34 ) and can be set to adapt to a specific application after installation. 2. Locking system in accordance with claim 1, characterized by means (610-666) for assigning a pointer corresponding to a desired key function to each location in the function table (219), where the means (610-666) comprise a programming key (624-644) in which a display is stored for each different storage location in the function table (219), and that the microcomputer (112) is operative under program control for reading the stored pointers from the programming key (624-644) in the function board (219). 3. Locking system in accordance with claim 2, characterized in that it comprises a battery (55) for electrical power supply to the microcomputer (112), and a battery voltage sensor (206) for detecting low battery voltage, the battery voltage sensor (206) being connected to the battery (55) and is connected to the microcomputer (112) input signal (Ril), that the keys include a room staff key (34,508) that a sensor (84) is connected to the lock (10) and to an input (R9) on the computer (112) for sensing the rotation of the door handle (18) when the door (10) is unlocked using the room staff key (34,508) that a room staff key counter (237) for counting the number of times said rotation is sensed while the battery voltage is low, that the microcomputer (112) is operative under program control to increment the cabin crew key counter (237) when the battery voltage sensor (206) indicates that the battery voltage is low and to prevent such an output signal when the number of registered cabin crew counters (237) exceeds a predetermined number except when the last used key was a room staff key (34,508), whereby the room staff key (34,508) must be used two consecutive times to unlock when the battery voltage is low when the room staff key (237) is used to open the door (10) more than the said predetermined number of times. 4. Locking system in accordance with claim 1, characterized by a storage register (225) for storing a logic relay flag (229) for inhibiting the microcomputer (112) unlock output signal when the flag (229) is set to a predetermined logic state, and the keys include an emergency key (34,508), and the microcomputer (112) is operative under program control to set the logic relay flag (229) in said logic state when the emergency key (34,508) is read by the key reader (38). 5. Lock system in accordance with claim 1, characterized by a locking device detector (84) connected to the locking device (14) and with an input signal (R9) to the microcomputer (112) to determine when the locking device (14) is actuated to the unlocked position, the microcomputer (112) includes a cycle clock, and the microcomputer (112) is operative under the program control of the main program to start the cycle clock when the key is inserted into the key reader (28) and to prevent further operations except when the locking device (14) is actuated within a predetermined time period.