CA2071577A1 - Electronic combination lock with high security features - Google Patents

Abstract

ABSTRACT

An electronic combination lock having a self contained power generation capability is further rendered more secure from attempts to open the lock by an unauthorized individual by requiring the checking the conditions of the lock operation against preset requirements so that if the lock is operated in a manner that indicates that the lock is being operated by a manipulator of if the lock is being randomly operated by a person, the lock will refuse to open or becomes inoperable.
Conditions that may be checked by the lock and compared to preset standards include: entry of the combination is too short a period of time, the entry of the combination over too long a period of time, the amount of the turn of the dial between stops of the dial, the requirement that the dial remain motionless for a predetermined period of time when the dial is reversed, counting the number of failed attempts to open the lock and signaling an error when a predetermined number is equaled or exceeded, the detection of a dial reversal and the backing up of the displayed number by a set amount to allow the combination number to be approached again without aborting the dialing sequence, counting the number of erroneous attempts and displaying that number to the operator when the lock is properly actuated and the counting of the number of times that the lock has been properly opened and displaying that number upon the proper operation of the lock. These features enhance the security provided by the lock itself.

Description

- -- 207 ~ 57 7 ELECTRONIC COMBINA'rION LOCK WITH
HIGH SECURITY FEA'rURES

BAC~GROUND OF THE INVENTION

~echanical com~ination locks ~uch as those fouIld on sa~es, vaults, cabinets and other hi~h ~ecurlty enclosures ar~ well known and subject ~o a num~er of attaclcs, such as by drilling, manipulatlon, and lû operation by dialer controlled by a compu~er.

Recently an electronic combination lock for 8uch nclosures has been inven ed which provides the opportunity ~o greatly increase ~he level of security lS af forded by the lock, while at the same time overcomes many of the ~hortcomins~s of the prior art mechanical locks .

P. dial ~ype con-binatic>n loclc relies on the rotation o:iE a 20 dial to positions represented ~y numbers cn the dial to rotate mechanl~al elements within the lock, ~uch that the wheels of the mechan~ sm align to allow a bar to drop into the wheels and retract the lock bar or bolt, allowing the enclosure to be opened.
~5 The electronic combination lock does not have the - 207~7~

e~uivalent mechanical elements and, therefore, can not be attacXed in the same manner. For example, the mech~nical lock may be drilled to permit the insertion of an optical device into the lock mechanlsm to ob~erve 5 the po5itions of the wheel~ and thus their al1gnment which permits the opening of the enclosure without the Xnowledge of the combination.

The electronic lock cannot be drilled for a similar purpose since the electronic lock mechanism will not reveal the position of any element which would be helpful for ~he attacker to observe and which would give the attacker any information as to the ~teps need to unlock the devlce.
~he mechanical lock has a fixed pos~ion o~ lnternal elements relative to the dial and thus may be observed with the movements of the dial repeated by the attacker, at a later time.

2~
~he electronic lock does not have a ~ixed dial to number position relation and thus observation of the movement of the dial is much more difficult if not imposslble.

2~ Dialers exist which may be attached to the knob of a dial on a comb~nation lock and which dial combinations ~H9- 9 1- 00 1 2~71~77 under the control of a computer. ~s each combination fails, the computer then continues to dial other combinat~ons ~o eventually unloc~ the lock.

With a combination l~ck of the mechanical type and sufficient time,a dialer i~ partioularly effective.

~he electronic combination locks are dependent upon electronic pulses bein~ generat~d to indicate to the elec~ronic con~rols, tha~ the dial is being rotated and in which direction. The pulses may be generated by conventional pulse generation means when a voltage ~upply is provided to power the pulse generator~

Alternatively, pulses m~y be generated by the operation of ~he lock and the the vol~age pulses provlde a power source ~or the operation of the lock.

This type of power source eliminates the need for a ~o ~eparate power source ~or ~he ~ystem, such as a batter~
or other external voltage supply.

~ith the control of the device by a series of voltage pulses, the use of the pulses may be used to further control functions of the lock.

MH9-91-001 .

2 ~ 7 ~ 7 SUMMARY OF THE INV~NTION

~he electronic combination lock d~sclosed and described herein is a combination lock having a dial which has no division~ or markings relat~ng to the number6 of the L
combination therevn. The rotation o~ t~e dlal drives a generator which produces electrical pulses. The voltage - puls~5 s~rve ~s a power source for ~he~electronics of the lock and to ~urthQr ~ndicate to the microproces-~or the æpeed and dir ction of ro~ation o$ the dial.

~hrough a random number generator/ the micro processor generates a psuedo-random number which is then displayed on a display which i~ mounted in proximity to khe dial.
The rotation of the dial of ~he lock is accomplished in a manner very closelr related to ~he manner of the ro~ation o~ the dial of a conventional mechanical combination lock.
When the numbers of the combination have been entered through dial rotation, the microprocessor compares ~he com~ination wlth the authori~ed combination; ~f the ~ame, a ~ignal ls sent to ~he motor hat will engage the latch with the bolt retractor and connect the bolt throu~h mechanical connect~ons, to the dial so that when the dial is further rotated in the proper direction the bolt will be retracted and the enclosure is then opened.
r The microprocessor is controlled by a ~oded progxam.
S The a~ility to control the microproce~sor with a L
microcoded cvntrvl program is a major advan~age in that the several functions and ~eature~ may be ~dded to ~ake ~he lock mechanism and the enclosure more ~ecure.

~n or~er for a dialer to be effective, the relationship between the dial rotation and the numb rs entered must be correllated so that a 3.6 degree rotat~on of the dial increments or decrements the entry number by one unit for a 100 unit dial. ~he generation of a random number within the microprocessor at the beginni~g of each number entry operation and the u~e of tha~ random number as ~he ~t~r~ing poin~ for the sequence of numbers displayed, eliminates the correllation of the number being dlsplayed and eventually enteredO and the di~l position.

Whzn the dial is r~tated, the generator creates pulses and these pulses are rece~Yed ~y and counted by the microprocessor. A~ the pulses are accumulated, the pulses are also timed ~nd the speed of rotation o f the dial ~s determined. As the speed of the rotation o~ ~he MH9-9 1-00 1 .

- 2~71~77 dial varies, the xate of change of ~he displayed numbers is chan~ed. This i5 accomplished so that at a high rate of rotation the displayed numbers may change ~t a high rate while at the lower rates of rotat~on, the rate of change o~ the displayed numbers may be by single units L
at a slower rate with respect to the amount of dial rotation. Further the number o~ degrees l:he dial must ~e turned to effect the chan~e of the di~played num~er will vary so that there 1~ no consistent amoun~ o~
1~ rotation required to change ~he displayed nu~ber by one unit. ~is aspect of ~he lock also acts ~o ~oil the u~e of a compu~er controlled dialer.

The timing capabillties of the lock providas the opportunity to determine the time u~ed in the enterin~
of the combination. I~ the total time of entry ~s either too short, indica~ing that the lock is under attack by a device rather than a human hand, or i~ ~ha time to en~er ~he combination is too long, indicating that the vperation of the lock ~s ~eing attacked by other than a person having knowledge of an authorized combination, the lock is prevented from opening even if the authorized combination ls subsequently entered.

As the connecti~n betwee~ the dial and the generato~ i8 mechanical and, therefore, a predictable one, the number - 2~7~77 of pulses received by the microprocessor indicat~s the x~tational displacement of the dial. The rota~ional movement of the dial by the hand of a human being ls such that the dial i~ generally turned less than 360 ~ degrees and then the dial is stopped while the operator releases the dial and acquire~ a new grasp of the dial.
The s~opping of the dial acts to allow a timer to run and if the stop perlod is less than a predetermined period that is related to human reac~ion t.ime, the stop of the dial ~ not rPcognized as a stop of the dial.
When the dial is rotated more than 4B0 degrees or 1.33 revolutions wi~hout a rec~gnized s~op, the lo~k is probably under attack by a device or at the very least by an unconventional dialing techn~que ~nd the lock will not open even, if the authorized combination is enter~dO

Dialers are cap~le o~ re~ersing directions of the dial in very short times and depend upon speed to open a combination lock ln a reasonably 6hort time period ~o without detection. ~his lock requires the dial be ~topped or stationary for a ~hort time periodically.
One of those times occurs as the d~al is reversed to enter the number jU5t dialed and to start access to the nex~ number to be entered. The timing of ~he stopped ?5 period of the dlal ~nsures both that a dialer is not being ~sed and it extends the time that is necessary to MH9-91-001.

2~71~77 open the lock by dialing all possible combina~ions until the lock ls unlocked by the proper comblnation. If the di~l is reversed in less than the predetermined t~me period required to detect a stop oE the dial, the microprocessor will not recognize ~he stop ~nd the incrementin~Jdecrementing of the numbers on the ~splay will continue in wh~chever ~ense they were changing.
Thi~ will foil the entry of a correct number and will set up a ~ondition where the lock will re.fuse to open due to more than a 1.33 revolution of the dial without a ~top.

~he microprocessor will also ~eep a count record of all the failed attempt~ to open the lock since the last ~S successful operation. If t~e numbers of trys or at~empts to unlock the lock equals or exceeds the number set in the ~icroprocessor microcode, the lock will ~ail to open even if an authorized combination is subsequently entered, prior to power down. After an error indication is displayed, the lock i~ disabled to prevent ~urther entry ~ri~s, unt~1 power down and power up .

~he sel$ contained generation of power for the lock electronics an~ con~rols creates a ma~or advantage since there is no need to provide a power source such as a MH9-91-001 .

- 2~71;~377 battery. ~he life of an ~pera~.ional power charge is limited, without further r~tation of the dial, and thus resets are not externally xequired. When a condition is -crea~ed where the lock will not open even with the eventual entry of the authorized combination, the lock L
electronics must be re~et. The reset is accomplished by letting the lock stand idle for a predetermined period of time without the dial rotation. ~urther rotatlon of the dial ~s ineffective to cause ~he lock ~o unlock.
Waiting for the predetermined time out to reset the lock is a maior deterrent to the success of a dialer which i~
dep~ndent upon speed and non detection.

The timing capability of the electronic l~ck provides an opportunity to prevent the use of a practice common with mechanical locks. To access the safe or vault on a sh~rt notice, it is common to dial ~n the first two numbers of a combination and then to no~ enter the third number. When the operator is ready to access ~he vault or safe, the third and final number of the combination is entered and khe enclosure is opened.

~his common and dangerous security violation, which severely compromises the security of the enclosure, is oYercome by the requiring of the complete entry of the com~ination within a preselected time period. ~he entry ~H9-91-001 2 ~ 7 ~

of two of three combination elements and the delayed entry of the third until after the relatlvely short time p~riod has expired, causes the scrambling of the entered co~bination numbers and the lock requires the complete ~omb$nation o ~e entered again.

The use of multiple combinations to open a lock i~
possible wi~h this electron~c lock even from a ~ngle lock mechanism~ The mechanical lock mechanisms ~re not capable of multiple com~inations be~ng entered into a ~ingle lock. Accord~ngly multiple lock mechani~ms are re~uired for multiple combinatlons to be used to ~nt~r the enclosure. The present electronic lock accepts .
multiple combi~ations in what $s referred to as a dual mode, re~uirin~ dual combinat~sns. ~he combinations may be en~exed in any order, ~ut if n error ~s made ~n ei~her combination the lock w~ll not signal that an error was made until after ~he second combinat~on i~
entered, thereby not informing the attacker of the part of the procedure which was in error. ~he tWQ
combinations may be considered as a eingle 12 digi~
combination raising the securi~y level of the lock, even though the combination is possessed by a single lndividual.

The lock may also be conditloned to accept the two M~9 - 9 1 -00 1 -- ~7:~77 separate combinations in a required order. The first combination requixed is referred to as the ~enior and t~2 later combination the subordinate. When properly enteredr the s~n~or comb~natl~n enables the locX to 5 accept the subordinate combination at any later time.
The repeated entry of the senior combinatlon deactivates the lock such that it will not accept the subordin~te c~m~ination until reactivated.

The electronic lock contains two counters that ~ay be used for security monitoring. The first counter is an error counter which is incremented each ~ime that khe lock ls unsucessfully operated. Thl~ count i~ retained in nonvolatile memory and the contents of the arror counter displayed on the display at the time of power on, if ~reater than two. ~he ~uthorized operator of the lock is ~hown an indication of the fact that the lock has been attacked and that the lock was not opened, ~ince the number in the error counter is not reset until a proper combination is entered and the lock unlocked.

The second of the coun~ers i~ referred to as ~he ~eal counter. ~he seal counter is incremented by one with each succe~sful opening of the lock. It is never res~t.

2S With ~our digits, the maximum count is 9,999 and would require over 80 hours of dialing the correct combinatlon ~9-91-~01 20~ 77 to i~crement the count completely around to the number originally on the display prior to attac~, if correct comb~nations wera entered at the rate of two per minute.
Thus by monitoring the the error and ~eal counters, the attack of the lock by an unauthorized ind:lvidual is L
apparent and whether the lock was properly operated to access the enclosure ~s ~nown to the auth~ri~ed operator~

.
The combination of the locX may be changed if the co~bina~ion is not known or forgotten, by using ~-he sexial number o~ the lock B5 a temporary combination.
This allow~ locXs that h~ve ~een ~tore~ in lnventory to be properly recombinationed by using the serial number of the locX, bu~ does not allow one with the serial number of the lock but not the authorized combinativn to . chan~e the combinatlon for later seemingly authorized access to the enclosure.

The invention described and claimed herein takes advantage of the electronic pulse con~rol o$ the electron~c lock and therefore it is an o~ject of the invention to increase the security level of the lock.

2~ Anoth~r ob~ect of the invention is to render the lock more resistant to ~he attack of the lock through attack N~9-91_001 ` - 2~7~ ~77 by drilling or penatrating the lock mechanism housing f or purp~ses of observation of the lock device.

An additional ob~ect of the in~ention is to render the 5 lock safe from successful attack ~or a substantial period of time by use of a dialer device.

Another ob~ect of the invention ~s to disable ~he lock from becoming unlocked, when the conditions of the combination input are such that they fail to fall within preselected parameters to insure that the lock i~ not being lattacked with a dialer.

It is a still additional ob~ec of the invention ko render the lock inoperative when predetermined ~ npu~
parameters are not met and ~he failure of the parameters ~o be met sug~ests that ~he lock operation i~ by other .han by a human being author~zed to unlock the lick.

~ is another ob~ec~ of the invention to prevent the lock from unlocking when the period of uninterrup~ed rot~tion of the dial of the electronic lock i~ in excess of a predetermined period.

It is another object of the inven~lon of pre~ent the lock from unlocking when the amount of the dial rotation MH9-91-001.

exceeds a predetermined amount, in a direction, without stopping the dial movement.

It is a still ~urther object of the invention to prevent S ~he lock from unlockin~ when the dial direction changes L
occur with such speed that the dial ls probably not operated by the hand of a human being.

An additional object of the inventi~n is that the lock will not operate to unlock if the dialing time exceed~ a predetermined amount of time withou~ either ~ucces~u:L
entry of the combination or the lock being powered down.

It is a another ob~ect of the invention ~o d~feat ~he use of a dialer by varying the correlation between dial displacement and numerical incremen~ation, depend~ng on the ~peed of rotation of the dial.

It is 9~ill an a~ditional object of thc inventlon to inhibit the use of a dialer by initiatin~ all ~equences of numbers displayed ~y the lock at a random number which has no rela~ion to the last combination number element entered.

Another object of the inven~ion i~ provlde the abllity to reverse and reco~er if a number is passed in the MH9-91-0~1 ` - 2~7:l577 d~aling, without hav~ng to restart the ~omblnation entry.

Still another object of the invention is to provide ln a ~$ngle combina~ion lock the capability of re~uiring entry of multiple authorized combinations prior to the lock being unlocked.

An additional o~ject of the invention ls to provide to the operator of the lock a visu~l d~splay o~ numbers tha~ w~ ndicate that the lock has been a~tacXed and the number of times the lock has been successfully operated.

A still fuxt~er ob~ect of the inven~on is to provide the capa~ y of opening the lock and changing the combinati~n ~f the lock, under controlled conditions, so that the combination of the lock may be changed ~r set when there is no record or recollsc~ion of the ~0 combination when the lock was storedc The fore~oin~ o~ects o the invention are accomplished by the electronic controls of the lock, as will become more apparent ~rom the detalled description of the ~nvention to ~ollow.

~9-91-001 - 2~7~7~

The foregoing objects aspects and advantages of the invention will become apparent from ~he drawings and the detailed description of the invention that will ~ollow.

DESCRIPTION OF THE DRAWINGS

Fig. 1 ~hows the electronie lock positioned on the door of a safe or vault and shows the location of the display and the dial of the lock with no markings as are ~onventional on mechanic~l co~bination locks.

Fig. 2 is a schematic diagram of the lock and its associated electronics.
Fig. 3 is a flow diagram of the logic control of the microprocessor of the electronic lock, showing the overall operati~n and control o~ the lock.

Flg. 4 is a logic flow dlagram representing the logic and operations to display numbers and symbols on the display .

Fig. 5 is a lo~ic flow diagram showing the logic operations that prevent the lock from opening if the combination is entered correctly, but in less ~han a ~9 -9 1 -00 1 --- 207157~

predetermined amount of time.

Fi~. 6 is a logic flow diagram showing the lo~ic .
operations that monit~r the amount of time that has elapsed for the ~tart of the open~ng operation wlth power up to the present, and the control of~ the lock to prevent the opening of ~he lock if the time reguired to e~ter an ~alid combination exceeds a predetermined amount of time.
Fig. 7 ~hows the logic flow diagram representing the logic operations that control the electronics to prevent ~he total diallnq period without a dial stop from exceeding a predetermined time and ~f ~o to prevent lS opening the lock, and to further insure that when the dial is left unturned for a preselec~d ~ime, the lock will not open without the en~ry of the entire comb~nation.

Fig. 8 is a l~gic flow diagram representing the logic control of the electronic lock to detect whether the dial of the lock has been turned more than than 480 degrees without the dial stopping for a period of more than a predetermined amount.

Fig. 9 is a logic flow diagram representin~ the logic MH9-91-0~1 2~71~77 control operations to detect the stopping of the dial and the timing of the stop, and if the stop time is sufficient to recognize dial rotatlon reversal, then to reverse the direction of the numbers displayed on the display.

Fig. 10 is a logic ~low diasram showlng the logic control opera~ions that tabulate the number of times errors occur in attemptin~ to open the lock, and ~he pr~venting of the opening of the lock i the number of erron20us attempts exceeds a predetermined number, wi h the resulting lock out of the opening commands snd disablinq of the display, if the correct combination is entered.
Fig. 11 is a logic flow diagram that shows the logic control operations ~o permit the recovery from a condition where the number displayed i~ past the tar~et number by less than 3 and allows the operator to reverse the dlsplay sequence and ret~rn to a nu~ber thaS is ~our units prior to the displayed number and to approach the target number again.

Figs. 12 and 13 are logic flow diagrams that illustrates the logic control operatlons of the microprocessor to convert the speed of the dial rotation ~nto a rate o~

1~

- 207~L3~7 incrementation of the displayed num~er.

Fig . 14 is a logic f low diagram illustrating the feature where the ~erial num~er of a lock is u~ed to operate the 5 lock, under ~ome clrcumstances.

Fig. 15 is a logic flow diagram illustrating the logic and operations which con~rol the use of and displayin of the cs)ntent~ of the error and seal courlters.

Figs. 16A, 16B, 16C, 17, 18, 19, 20 and 21 are flow diagr~ms e~spanding operations illustrated in previou~
f igures .

15 Figs. 22 and 23 illustrate alternat~ve embodiments of the feature causinS~ the loclc to not open a~ter a predetermisled nusnber o~ consecutive erroneous attempt~, in logic ilow form.

20 A more complete understanding of the invention may be ac~uired ~rom the following detaîled de~crip~ion ~ ~he in~ention tha~ follows.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

OF THE INVENTION

MH9-9 1-~0 1 ~L9 2~7~37~

Referring to Fig. 1, the lock 10 in which the invention is embodied is shown mounte~ on a ~a~e or ~ault door 12.
~e dial 14 is surrounded ~y a housing 16 which shroud~
the per$phery of the dial 14 and supports the di~play ~8. I~ pre~erred, display 18 may ~e ~unted ~eparat~ly L
from the dial 14. ~he dial is a Liquid Crystal Display (LCD) module, but could be any other low power consumpti~n display devlce~ ~he dial ~4 ~s attached to a ~haft 20 extending out the bac~ of the dial ~echanigm, throu~h the wall of the safe or vault door 12 and into hous~ng 22 of the electronics 24 of the lock lO.

Extending from the ho~sing 22 is a bolt 26 that i~ used to hold the ~oor 12 shut when extended. Also contained in the housing 22 axe the mechani~al linkages and mechanisms which retract or exten~ the bolt 26 of the l~ck 10.

In Fig. 2, the dial 14 is connected to the rotor 28 and ~o the retractor drive 30. Rotor 28 is a segmented magnetic member hav~n~ a plurality of magnetic ~egments 32. The number of magnet se~men~s 32 on the rotor 28 is not critical and may selected to provide as many field direction changes as des~red per revolution of ~he rotor. ~he magnetic fields of ~he maynetic segments 32 extend to and interact with the coils 34 which are M~9- 9 1-00 1 .

20~77 placed in proximity to the rotor 28, to generate a p~lse of electricity. The generator 29 may be a stepper motor driven as a generator. As the rotor 28 is rotated by the dial 14 and shaft 20, 6erie~ of pulses are generated which are fed to the power control a~d pulse shaping device 3~. ~he shaping of the pulses is accomplished by circuit~y that is conventional and forms no part of this invention. ~he pulses are then fed to the microprocessor 44 over the two pha~e lines 38 and 40. The pulses are out of phase so they may be used to determine the direction of the rot~tion o~ the rotor 28.

The power control and pulse ~haping device 36 also charges an interna~ capacitor wlth the pulses o~
lS electricity genera~ed by the rotor 28 and coils 34. ~he voltage of the capaci~or ls then supplied over the power line 42 to the microprocassor 44. The micxoprocessor 44 , . .
is powered for a l~mited t~e wit~ the voltage, and the char~e is ~tored ln a capacitor with~n the power control 360 Powered time of ~he microprocessor 44 is dependent upon the capacitance of the capacitor and the current drain of the microprocessor 44 and display 18. The size of the capacilor is ~elected in coordinat~on with the power requirement~ of the remainder of the ~ystem to pro~lde power to the system for approximately 90 seconds after the dial 14 and the rotor 24 have ceased to ~H9-91-001.

- 2071~77 rotate. This time period provides adequate time to open the lock 10 or to pause in the entry of the combination without losing the previously enterad el~ments ~f the com~ination. On th~ other hand, the time perlod i~ log 5 enou~h to pro~ide a signi~icant delay in the reset of the lock electronics 24 after the lock has become unopenable due to any of several conditions having occurred. This delay period is a slgnificant factor to defeat the u~e of a dialer.

~icroprocessor ~4 provides outputs to a display 18. The display 18 is capable of displaying numeral~ of at least two digits and arrows pointing in oppos~te d~rec ions.
Symbols such as a lightning bolt for a error symbol or a key symbol are used to indicate selection of the combination change mode.

~he pref~rred display 18 is a Liquid Crystal Display or ~CD device which has the ad~antage o~ being a relatively low consumer of electrical power. Low power consumption is a ~ignifican~ consideration since powe~ generated ~y the rotation of the lock d~al 14 is relatively small and must be stored within the components of the electronics of the power control and pulse shaping components 36 of the system.

~H9-91-001 - 2~71~77 The microprocessor 44 also has an output to the latch motor 46 which acts to connect the latch 48 of the lock 10 to the bolt xetractor 50. ~he latch 48 is ~n arm wh~ch when engaged with the bolt retractor 50 may be pulled or pushed by the ~olt retractor 50, when it is moved. A small rotary motor 46 for moving the latch 48 is preferred. The latch 48 is constrained by the lock housin~ ~ in Fig . 1, for sliding movement and 1~
extended or retracted as necessary to lock or unlock the enclo~ure 56.

Bolt retractor 50 is engaged with the retractor drive 30 by the link 52. The link 52 converts the movement of the retractor drive 30 and engaginq point 58 into a linear movement ~f the bolt retractor 50.

The micropr~cess~r 44 may be any suitable microprocessor manufactured and sold vn the marke~. ~owever ~he preferred embodiment of the ~nvention include~ a micr~processor designated 80C51F and manuf~ctured an~
~old by Oki Electric Industries Company) Ltd, of Tokyo, Japan.

The operation of the microprocess~r is represented by the flow diagram of Fig. 3. ~he following deseription will explain the microprocessor 44 logic opera~ions and MHg-91-001 2~7~3~

flow as the lock 10 is operated.

MICROPROCESSOR OPERATION AND COM~ROL

5 Referring to Figure 3, the ~y~tem begins ~Eunctlonin~
when the generator 29 provides sustaining power to the electronic logic or microprocessor 44. This is represen~ed by opera~ion 800.

When the power is su~ficient, the first func~ion of the system is to clear the total try coun~er in operation 810. This permits the opening of the lock 10 with the authorized combinatlon even if the lock 10 had been .
disabled due ko a sufficient number of erroneous combination entr~es ~o prevent the lock from opening.

~herea~ter, the Random Access Memory ~AM), within the microproce~sor 44 is initiali2ed and all bit switches or flags are reset to their de~ult condi~ions, in operation 812. This conditions the system ~o accept input3 from the dial 14 of the lock 10.

The random number generator of the microprocessor ~, in operation 814, generates a random number between 00 and 2S 99 and loads the number into ~he combina~on counter.
This provides th~ system with a start~ng point for the 20~1a77 electronics to work from ln the accepting of combination element entry.

In operation ~16, a det~rmination is made ~ to whether 5 this operation is the result of a power on entry int~
the system or a restart entry lnto the system. If thls operational seguence of the ~ystem is due to power on, ~he flow ls to operation operation 818 wl~ere the direc~ion of the dia~ 14 determined from the phase lO relatlon of the pulses. If ~e dial ~4 is being rota~ed ~n the counterclockwise direction, the flow branches to operation 822. However, if the rotation of the dial 14 i8 cloc~wise, then the seal counter number is displ~yed, in operation 820, until the dial 14 is turned counterclockwise.

The flow from operations 818 and 820 both converge on operation 822 where it is ascertained ~f the error counter contains a ~ount greater than ~. If not, the fl~w ~ranches to operakion 826. If the err~r coun~er contains a count ~f 3 or more, the flow is to opera~on 824 where the number is displayed on display 18. The operator is ~hown ~he number of unsuccessful attempts made to open the lock 8ince the last successful entry attempt.

MH9-91_001.

--- 2~7~7~

Thereafter the flow is to operation 826. In this operation $here is a decision as to whether the watch dog flag is ~et. The watch dog flag, when ~et $ndicates whether the lock has been left wi~h the dial unmoved or the dial has not stopped for mo~e than 40 seconds. If the flag is set, then the flow branches back to ~ust pr~or to operation ~12 where the lock is reinitialixed and the lock conditioned to be opened with a new combination entry attempt.
1~
When ~he watch dog flag is not set, opera~ion B28 will determine ~f the dial 14 has been rever~ed and i~ ~o t~he flow is block B30 which represents the ~ubroutine show.n in Fig. 16. Following rentry ~o the main system flow from Fig. ~6, the direction change is processed in operation 832 and a check is made in operation B34 as whether the display swi~ch or bit is set ON. If the determination ln opera~ion 83~ is true, then ~he ~ubroutine in Fig. 4 is entered and completed and the combination i5 then displayed in ~peration 838. When the display bi~ or switch is not on, then the flow branches back to the iust prior to and reenters operation 826.

Referring to Fig. 16, Block 830 represents entry int~
the subroutine, and the numbers in the combina~ion - 2~71 ~7~

counter are saved as an element of the combination in operation 850. Thereafter the decision i8 made in operation 852 as whether all elements of the ~ombination have been entered. If not, the ~l~w returns to the main ~ystem flow ~nd reenters at operation 832.

If all the numbers for the combination have been entered, then there i5 ~ determination at ~perat~on 854 as to whether ~he operation of the lock is condl ioned for single combination operation; and if true, the combination is ~ompared with the ~tored authorized combination in operation 856. I~ on the other h~nd the lock is not conditioned for single combination operat~on, the flow branches at operatiQn B~4.
~f at opera~-ion 856, the combina~ion does not match ~hen the error si~nal is ~et and the ersor counter is updated by incrementat~on by one, ~n operation 860, and then the flow i5 to ~he restart entry point 862 in ~ig 1~.
Referring back to Fig. 16, if ~he com~ination matches in opera~ion 856, the ports 62 of m5croprocess~r 44 are checked to see of the change key 60 has been inserted.
If ~he change key 60 has been inserted into the p~rts 2S 62, then the ~low is to block 864 which represents the subroutine sh~wn in Fig. 17. Upon comple~ion of the ~H9-9 1-001 .

2071~377 routine of Fig. 17, the flow returns to operat~on 8~6 where the new com~ination is gotten and confirmed and used thereafter as the authorized combinat~on, in operation 866. Th~n the flow is directed to the restart entry point in Fig 15, operation 862.

If the change key 60 has ~ot been inserted, then the flow at operation 8~8 branches to the subroutine in Fig.
18 as represented by block 868 and upon completlon of the rou~ine in Fig 18j the lock is opened in operat~on 870. Thereafter, the flow is to res~art entry 862 in Fig. 15 to await any fur~her action.

Referrinq first to Fi~. 17, the condition of the lock is checked to see ~f a second combination i9 requ~red to open the lock, in operation 900. If not the flow branches around operation 90~, to operation 9~4. If a second combination is required to open the lock, then ~he second combination is gotten in operation 902, from the d~al input.

In opera~ion 904, the type of operation is selected such as single, dual or ~eniorJsubordinate operation. In operat~on 906 if the de~ermination is that it i~ a single combination mode of operation, the flow is to operation 908 which represents the subroutine shown in . -- 2~7~7~

Fig. 19; when the routine in Fig. 19 is complete, the flow will return to Block 910 where the single combination is acqulred ~or the dialing procedure.

If ~he determination at operation 906 1s tha~ ~he lock i~ operating in a mode other that a single mode, the flow is to block 912 which represents the ~ubrou~ine of Fig. 20; and when that ~ubroutine is compl~te, the flow is back to operatlon 914 where the operat~on receives two combinations and th~nce to the main routine in Fig.
16 at operation 866.

Referring to ~ig. 16, block 86B represents the subroutine shown in Fig. 18. In Fig. 18, the error counter is checXed, in operation 952 to determine if the count i9 ~rea~er than 9 and if the num~er i~ grea~er than 9 the flow is to operation g68 where the di~play is blanked and to operation 970 where the microprocessor 44 is locked up or disabled. The routlne then ends at operation 970. The electronics 24 must then power down prior to reinitiation of operation at power on entry at 800 in Fig..3.

When the error counter is Y or less then the t~me of en~ry of the combination is checked; if less than 15 seconds, the flow is to operation 960. If the diallng MH9-gl-001 -` 207~77 ~ime to enter the combination is greater than 15 seconds, then the flow is to operation 956 where the total time of dialing is ascertained and compared to 5.12 secon~s. If the t~me is greater than 5.12 seconds, then the flow ls operatlon 960, and if 1~5s, then ~o operation 958 where th~ amount of dial rotation without a ~top is compared to 480 degrees. If more than the 480 degr~es, the flow is to operation 960. Xf less than the predetermined 480 degrees, then the write new comb.ination flag is chec~ed at 963 and if ON then the new combina~-ion is written to memory in opPration 965.
Thereafter, the combinatiQn is read and rewitten to combination memory in operation g66 and the ~low continues to ~62.
Then the open lock subroutine of Fiq. 21 is accesse~ in block 962, with the flow returning to operation 964 which opens the lock. Thereafter the flow returns to operation 870 Referring to Fig. 21, in operation 970, the lock is opened and the error counter is reset, as ~he contents of the error counter is representa~lve of unsuccessfu.
attempts to open ~-he lock 10 following the last 2~ ~uccessful operatlon. Further, the seal counter is updated by incrementing its contents by one to reflect . - 2a7l~77 the lates~ ~uccessful entry. Then the flow retu~ns to operati~n 964.

D~AL A~D SENIOR/SUBORDINATE COMBINATION FEA~URE
Referring to Fig. 16, operation 854, if the lock 10 requ~res more than vne combina~on to unlock the lock 10, then ~he flow branches ~o Opera~ion 874 where it is determined if the lock is a dual co~binat~on type operation. When the operation is a dual combination type operation the combination match is checked ln oper~tion 876 and if the combination does not match either authorized combination, the the error flag i~
checked at 877 and if ON the error si~nal ~s actlvated, the lightni~g b~lt ~g displayed ln operation ~60 and the error counter updated. The error flag ls ~hen r~se~ at 861.

Should the error ~lag be OFF in operation 877, the the error 1ag is set 879. ~he flow from operatlons 879 and 861 is to restart entry 862.

When the comb~nation matches, the ports 62 of the microprocessor or logic con~rol device 44 are checked to ~ee if the change key 60 is in~erted. If ~ot, the decision is made in operation 880 as to whether one -- 2~71~7~

combination has already matched and, if so, the ilow is to the subrou~lne in Fig. 18. an~ then back to operatlon 870, previously de~cxibed. If operation 880 determines that no previous combination has been ma~ched, then a S flag is set in operation 882 to ~ndicate t:hat one combination ha~ been matched. ~hen the flow is from operation 870 or 882 back to the restart entry point 862.

Referring to operation 874, if the lock i5 not ~onditioned to open in response to a dual combina~ion entry, then the ~low branches to operation 858, pre~iously de~cribed and i~ the key 60 iB inserted then to block 864 ~nd 8~6 and then to restart entry 862, all previously described.

If the chan~e key 6~ is n~t inserted into th~ ports 62, the co~bination is compared in operation 8~0 to the senior combination and if matched, then the ~e~ior combination ~lag i~ toggled on~off in operation 892.
This either enables the ~ubordinate combination or disables the accep~ance of the subordinate combination re~pectively.

When the com~ination does not match the senior combination in operat~on 890, operatlon 894 checks to 2~71~77 ~ee if the senior flag is set ON and, if so, the combination is checked again~t the subordinat com~ination in operation 896. If either of the operations ~94 or 896 test not true, then the flow from the respective operations is to operation 860 whioh has been previously described.

When the combination matches the subordinate combination ln operati~n 896, the flow is to block 868 which represents the subroutine in Fig~ 18, which has been previously described, together with operation 870. ~he flow from operations 860 or 870 is to restart entry 862 in Fig. 15~

~5 Referring to Fig. 17, block 912 represen~s ~he subroutine ~llustrated in Fig. 20. Upon en~xy to the subroutine in Fig. ~0 the new combination is acquired or re~d from the dialing operation as the first of two combinations, in operation 1000. Then in operation 1002, the combination is flashed back to the operator, permitting the operator to observe the combina$ion that has been entered and changed. Af~er the the combina~ion has been flashed back to the operator for ~everal ~equences, the logic con~rol will flow to operation 1004 where the new combination, the second of two, is read from the dialing operation; the new, second combinat~on MH9-91-001 , 2~7~77 is flashed ~ack to the operator for verification. After the the flashing ceases, as in operation 1002~ the message "P0", standing for Pull Out is displayed on the display 18 to tell the operator to pull the change key 60 from ports 62. At this point, ln Figs. 19 and 20 at operations 1058 and 1012 respectively, the change key symb~l is t~rned off and a message "CC" ls ~splayed ~o pr~mpt the operat~r t~ conf~rm the combination(~) by enteri~g the new c~mbinations(s). Thence, the bolt 26 is retracted and the new eombination(s~ are ~tored in combination memory, completing the change of combination operation.

After the message "P0" is displayed, operatlon 1010 will continue to sample the ports 62 to determine whether the change key 60 has heen removed. The looping and sampling will c~ntinue un~l the ~ey 6~ is con~lrmed ~s removed, wher~upon, in operation 10l2, the write new combination flag is set and the flow retur~s to the flow in Fig. 17 at operation 914.

Referring again to F~g. 17, Block 908 represents the subroutine illustrated in Fi~. 19. ~hus bloc~ 908 $s expanded into a subroutine and when the subroutine in Fig. 19 is complete, the ~1QW returns to operation 910 of ~ig. 17.

~7:1~77 In Fig. 19, the flow enters the subroutine at 908 from F~g. 17 and the new combination is read or retrieved from the co~bination memory in operation 105~4 To allow operator verification, once the combination has been retrieved, it is fla~hed back on the di~play 18 to the operator. After the combinatlon has been d~played to ~he opera~or, operation 1054 signal a ~essage "PO"
to the operator prompting the operator to Pull ~ut the change key 6 0 ~rom the ports 62.

The ele~tronic control of the lock then attempks to veri~y in operation 1056 that the change key 60 has been removed for ports 62, signi~ying the completion of the combination change; if the key 60 has not been removed, ths logic operations continues to verify until such time as the key 60 is removed. Only when the key 60 has been removed, will the control logic flow progreæs to operation 1058 where the the new comb$nation ~lag 1~
written into ~emory. Thereafter the flow returns to operation 910 in Fig. 17.

Block 836 of Fig. 3 i~ further expanded $n Fig 4.
Referring to Fig. 4, the flow enters at block 826 and then converts the t~ns data to segment data. The MHg-91-001 " - 2~7~L~77 display 18 is of the type where the numbers displayed are made ~Ip of segments that are turned on or turned of f and the ones turned on in conjuction with the others turned off form contrasting bars against the background S of the display, making ~isible ~umbexs. ~h$s operation 1100 converts, thru a table look up, the number in the tens position of the display, to data ~its, ones and zeros, necessary to turn on or off the ~e~ments of the display in the tens position.

~ext a cheek in operation 1102 is made to acertain if the display is di~playin~ a combination number or a number which represents the mode of he lock 10. The mode of the lock ls set, to condition the lock lO to be opened with one comb$nation, a min~mum o~ two combinations or a combinat~on which must be entered before any 6econd combination is entered, ~nown as the senior/subordinate mode. When the display 18 is respondlng to the opera~ion of the lock 10 ~o indicate what mode i~ is to operate in, ~he display lB is displaying a ~ingle uni ~ digi~ and no zero in ~he tens posi~ion. During this phase of the loc~ 10 operation, operation llD2 will pass the flow to operation 1104 where the segment data for the tens position of the display 18 will not be set. When the lock 10 is in its normal operational mode of accepting combi~ation lnput, M~9-91-001 -- 2~71~77 th~ flow is through the NO path from operatlon 1102 around operation 1104t to operation 1106 where the units d~ta i~ converted to ~egment data ih the same manner as the conversion 1n operation 11~0. Then the lightn~g bolt, ~ey and left and rlght arrows are ~et ON or OFFas appropriate.

A$ter the conditions are set~ the display data is written to the display 18 to cause the display to show ~he appropria~e symbols, in operation 1110. Thereafter ~he flow returns ~o operation 828.

With thls understanding of the operation and control of the microprocessor, the operation of the mi~roprocessor wlll be described with respect to the several security features.

RANDOM NUMBER S~ART

As the dlal 14 of the loc~ 10 is rota~ed and pulses ~rom the generator 29 are 6haped and transmitted to the microprocessor 44, data is generated an~ passed as input to the m~croproceæsor to input combination numbers to the . ystem. On mechanical combination lock~ the dial has on its per~phery marks and numbers ~ha~ the operator must align with a guide mark to proper~y position the MH9 -9 1- ~0 1, ` 2~7~77 wheels in the lock. With this invention, not only are there no such marks or numbers, but the electronics 24 must generate the signals representing the numbers which activate the LCD device to display numbers for S observation by the operator. If the first number displayed at the beginning of a movement of the dial 14 to increment or decrement the numbers displayed, were ln ~ome relation to earlier numbers entered into the lock or were consistently the same, a dialer could be programmed to account for that datum point. Only one unsuccessful attempt to open the lock 10 would be necessary for the attacker to ascertain the relationship. In the instant invention, the microprocessor 44 has included within its capabilit~es the ability to generate psuedo random numbers between 00 and 99. The random number generated is displayed and used as a base point or datum point from which to start that sequence to enter a number of the combination.

Referring to Fig. 3A, at block 814 the random number generator of the microprocessor 44 generates or picks a number between 00 and 99 inclusive in operation 102.
This number is entered into the combination counter of the microprocessor 44 and displayed on the display 18.

As the dial 14 of the lock 10 is rotated, the generator . - 2~71~77 29 provides a pulse train with one pulse corresponding to the rotation of ~he dial 14 by an amoun~ of choice, typically one pulse for each three degrees o~ rotation.
~he generator may be a permanent magnet stepper ~okor and the resolution o~ ~he motor steps wi~l dlctate the ' number of steps per revolution and thus the resolution of pulses for any amount.of rotat~on.

The pulses are then oounted and the microproces~or 44 determines the number of pulses necessary for the microprocessor 44 to increment or ~ecremen~ the number on the display 18 by one and increments or decrements the displayed number by one, as wlll be axplained with respect to Fig. 13. The ~low in Fig. 13 and ~ubordin~te routines control directin and other fa~lts o~
the operation.

Frsm the foregoing, it can be ~een ~hat the random number generator of the microproces~or 44 will start each number entry sequence at a random number which will in all probabillty not be the same as ~hat of any other sequence in the lock openLng operation. This prevents the d$aler ~rom being able ~o increment the numbers entered in an up or down directlon, from a known 25 starting point. This severely restrict~ the use of a d$aler. This fea~ure of the operation of the lock ~H9-91-001 .

2~7~77 significantly improYes the ~ecurity of the lock by defeating one ~ignificant method ~f ~urrepticious attack on $he lock 10.

FAST ENT~Y LOC~ OUT

Since the mai~ purpose o~ a dialer is to attack a combination lock by very rapid dialing of all the combinations necessary o open the lock, it is de~irable to ~low down ~he entry of lock combinationsO By slowing the ~cceptsble entry of a combination, it insures th3t the lock will ~tatistically withstand ~uch an assault for a longer time. If a d~aler were devi~ed to overcome ~ome or all of the other sa~eguards and features ot the lock, ~lowing the accep~able entry rate w~ll reduce the number of entries that may be a~tempted in a given period of time. Slnce time i~ an enemy of the attacker, and exposes them to detect~on over longer time periods, anything that will delay the attackers success is of ~o great importance.

AccQrdingly, the electronic lock 10 is pro~ided with a timer within the microprocessor 44 which times the period from power-on until the en~ry of the last number of the combination. The logic flow diagram of Fig. 5 illustrates the flow for this ~ecurity enhancing feature MHg -9 1-001 2~7~ 577 of the lock 10. Fig. 5 is an expansion of Operat~on 954 of Fiq. 18.

The internal clock timer of the m~croprocessor 44 i8 started at power-on when the microproces~or 44 is supplied sufficient power ~rom the pulse shaping And power control 36 to operate the ~lectronics ~4 a~
represented in block 150. The lock electronics 24 w~ll then accept the entry of the combination numbers normally, as illustrated in block 152. In deci~on bl~ck 154, the condition is tested as whether all numbers of the comb~nation h~ve been entered; and if found to be false, then the ~low loops back to ~ust prior to oper~tion 15~ which ~llows the next combinati.on 1.
number to be en~ered. When the conditlon tested in operation 154 is sati6~ied, the loop is exited and the flow i~ to operation 156 where ~he tlme ~rom the s~art of operation, i~ contained in the timer that was started ln operation 150, is tested to determine if the elapsed time has been greater than a predetermined time period. For exampl~, the time period may be selected to be 15 seconds, s~nce a human being operating ~he lock dial 14 will take longer than 15 seconds to en~er the comblnation, normally. Thu~ it may be ~a~ely assumed that any entry in less than 15 ~econds is an at~empt to attack the lock w~th a very rapid non-human device such ql 2~7~77 as a dialer.

If ~he time is le~s than 15 seconds, then the flow branches to operation 162 where a ~ignal i displayed indicating an error. The symbol of the preferred embodiment is a lightning bolt. After the error is signalled, the lock logic ~low xeturn~ to the main system flow and the lock will not open until a correct combination is entered and the entry ~ ime is greater than lS seconds.

If the time period is d~termined to be greater than 15 seconds, ~n operation 156, t~en the flow 1~ to op~ration 158 where the combination is te~ted or compared with the ¦.
lS correct combination o~ ~he lock ~0 ~y the microprocess~r 44 if not correct, th~ error signal is displayed in operation 162.

If the combinatio~ is found to be correct ~n operation 1~8, the lock i~ opened or a chanye of combination is effected, in operation 160, when the chan~e key 60 is inserted in ~he change key ports 62 of the microprocess~r 44, Use of the change key 60 will be discussed in more detail below.

The testing and signaling of an error when the MHg-9 1-0~1 2~7~ ~77 combination is too rapidly entered acts to defeat the operation of a dlaler. According1y, the se1ect~on of a minimum time whlch must be exceeded in the ent~y of a com~ination enhances the security o$ the lock 10.

MAXINUN ENTRY TINE FEATURE

If the lock is dialed ~y an attacker and ~he correc~
combination ig not entered in a period of time th~t is preselected, ~uch as for examp1e, 5.1~ minutes, ~hen it ~s assummed that the 1Ock is under attack by some device or a persistent indlvidual. The security features of the lock 10 ~re primarily aimad at the de~ea~ o~ a dialer, and may not be trlggered, but the 1Ock needs to be protected from a~tack by an individual. Thus, if the dialing time exceeds the maximum, then an error is ~ignaled and the lock will not open.

The logic opera~ions for ~his feature are shown in Fig.
6 which ~s an expansion of operat~on 956 o~ Fig. 18.
With operation 200, an elapsed ~ime time~, of the ~ame type as used in the ~low dia~ram of F~g. 5, i~ s~arted at power-on. The numbers of the combination are then allowed to be entered in operation 202, and after each number is entered, the combination is tested in opera~ion 204 to determine if the last number of the MH9-91-~01 2071$7~

combinatLon has ~een entered. If the last number has not been entered, the flow loops back to just prior to operation 202 to permit the ~n~ry of the next number of the combination~

After the last ~umber of the combinat~on i~ entered, in operation 202, and the determination of operation ~04 i~
~a.isfied, the content of the t1mer is tested to de~ermine lf the to~al time e~apsed ~ince power-on has exceeded ~.12 minu~es, as an example. If the time period has been greater than ~.12 minutes, the lock electronics ~4 ~ignals ~hrough the display 18 ~n error signal~ as shown in operation 212 and the lock wlll not open. Tha lock is at this point unable to open ~ince there is a signal to prevent the unlocking of the lock 10 and the lock will not open, eYen with a corre~t combination, since operation 210 is bypassed. The lock will continue to accept the ~nput of numbers ~o the lock and will open if the next combination entry i5 CQrreCt.
With an entry time exceeding 5.12 minutes ~here is sufficient delay ~hat an addi~ional time of 90 ~econds to power-down the lock i~ not a significan~ deterrent.

When the test of the time period elapsed i~ less than the predetermined time period of 5.12 minu~es, ~or example, the logic flow is direc~ed at operation 206 ~o MH9_g~-Oûl, - 2071~7~

operation 2û8 where the combinatLon is checked for correctness; and, if correct the lock is opened or the combination is changed when the chan~e key 60 is resident ln the ports 62 of the microprocessor circuitry 5 in operatlon 210.

I~ on the other hand the com~ination entered is incorrect, the error xi~ gnal is displayed in operation 212 .

Since ~hort times are an advantage ~o the securi~y of the lock and ~ ong perlods of s:~perating time are advantageous to the atl;ackert ~he advantage to a~tack~r is removed.

MAXIMU~ UNATTENDED PERIOD SAFEGU~RD FEATURE

A common and ~erious security viol~tion is to enter ~he first two numbers of a combination ~o that the third number may be en~ered at ~ later time with a minimum of delay in accessing the enclo~ure. This pra~lce allows one who knows only the last number of a combination to access the enclosure.

The electronic lock disclosed herein has a capability to defeat a partially entered combination and thus return MH9-g1-001 2~7~77 the lock to a scrambled locked condition. Fig. 7 represents the logic flow of the maximum unattended period feature of the lock 10. ~he feature starts with power-on, in operation 250. As power-on is accompli~hed, a timer ls ~et to the period of time ~elected for this feature. A preferred per~od of time is typically 40 second~. The microprocessor 44 then checks to ~ee if the dial 14 of the lock 10 has stopped rotating for a period at leas~ a predetermined amoun~
such as 220 milli~econds, by way of example. This period is ~llghtly less than that necessary for the operator to release the knob and regrasp the knob of the dial 14 and s~art to rotate the dial 14. If the dial has stopped for ~ore than ~he minimum stop re~uired, the logic loops back to ~ust prior to operation 252 to effectively reset ~he timer ~o the predetermined period each time the dial 14 is al1Owed to remain motionless for ~he requir~d stop period ~ollowing a rotation. If the requ~red dial ~top period is not met, then the flow of operations is from operatlon 2~ to operation 256 where the unattended timer i~ polled to 6ee if the period of 40 seconds has expired. If it has expired, the the lock has not been operated within the allotted time and is not allowed to unlock because ~he electronics 24 have been signalled to not open the lock.
Thic operation is on an interrupt basis and aftar the M~9-91-001 2~71~77 operation, the overall system operation continues.

If the timer has not expired, the flow branches ~rom operation 256 around operation 258 and back to the main ~ystem operation as the interrupt is completed, at restart entry ~62.

This features affect is that if the dial 14 of the lock 10 is not ~uned wi~hin 40 seconds or if the dial is has no~ ~topped for a period of 220 milli~econds within the 40 ~econd timer period, the numbers of the ~ombination already entered are ignored and axe not effective to form part of the combination ~o unlock the lock. ~hi~
pxevent~ the operator from ~ntering the firs~ two ~5 numbers of the combina~ion and waiting until 5 t~nificantly later to enter the third num~er o~ the combination to quic~ly open the ~ck 1~.

DIAL ROTATION LIMIT

The use of the human hand to rota~e ~he dial 14 of ~he lock 10 results in the dial 14 being turned a partial turn and the dial 14 6topped and the hand repositionecl to att~in a new grasp of the dial 14 prior to the next 2g turn. If the dial turns more than what a normal hand/wrist will permit, the lock typically is being MH9-91-001, . ~71~77 opera~ed by a d~aler or similar device. To ~ense this and to preven~ the lock lO ~rom opening, the amount o~
dial r~tation without a stop ~s detected. This feature ~f the invention is illustrated in Fig. 8, whi~h is a S more detailed expansion of operation 958 of F~g. 18.

After power-on in operation 300, the pul~;es from the ~enerator 2g are monitored and it is detenmined whether the dlal l4 has stopped turning, in operation 302. If the determination of operation 302 is that the dial has not stopped turning~ then the log~c control flow loops ~ck to ~ust prior to operation 302 and the pulse outpu~
of the generator ~9 is again monitored. This loop continues until the dial 14 is detected as havin~
lS stopped turning. When the ~ial 14 has s~opped the ~ogic flow branches out of the loop to operation 304 where the nu~ber of pulses generated ~$nce the 1~ dlal stop is determ~ned and compared wlth 160 pulse~ which ~s the number of pulses generated by the rotat~on of the d~al 14 by l.33 urns or 480 degress.

If the dial has rotated more than the predetermined amount of 480 degrees without a ~top of the dial the flow is directed to operation 306 where the lock electronics 18 are signaled to not open, even if the correct combination is entered.

MH9-9$-OOl.

2~7~77 As descri~ed above, the operation of the 7 ock 10 by a person i~ not inhib$ted while the operation of the loc~
10 by a dialer or other similar device is s2verely inhibited ~ec~use the lock will not respond to the correct combination after the dial is rotated ~or more than 1.33 turns without stopping. If the dial stops for less than the amount Df time necessary for the lock e1ectronics 1~ to recognize a dial stop, then the timer is not re~et ~nd the locX 10 wil~ at ~he end of the time period, be rendered unopenable, as in Flg. 7, until th2 lock powers down and is reset by a new power-on ~equence. Thus lf a d~aler is used and the lock i~
rendered unopenable, the ~ubse~uent inputs by the dialer are not reco~nized, even i~ correct, ~nd the enc1Osure is not openable.

DIAL STOP INITIATED REVERS~L OF NUMBER 5EQUENCES

~he dial 14 must phy~ically stop rotating whenever a number of a combination i~ reached ~nd the number ls entered into the microprocessor 44 as an element of the combination. However the time that the dial 14 is motionless is important since the reversal of the dial 14 of th0 lock 10 is used to detect that a number is to be entered into the combination element storage 2~7~77 locations of the microprocessor 44. If ~he stop period is too sh~rt, microprocessor 44 will not recognize the stop and the rDtation of the dial will continue the incrementation of the numbers in the same direction, ~ncreasing or decreasing, as was in effect prior to the stop and reversal of the dial. Thls has the dual effect of further destroying the relatlon between the dial 14 rotation and the numbers displayed ~nd operated on by ~he m~croprocessor 44, and to prevent ~ enteriny of the number displayed at the time of the stop. ~he opera~ion of the logic ls lllustra~ed in the flow diagram of Fig. 9.
.

With power-on, the pulse output of the generator 2g is monitored and a determination made as whether the di~l 14 has stopped, in operation 352. If the determination is 1n the negative the flow loops back t~ again pass through the decis~on operat~on ln operation 352 until the result i~ in ~he affirmat~ve. At that time the flow branches out of the loop and is directed to operation 354 where the time period is tested as to whether the ~topped period exceeds 220 milliseconds, the minimum time period that is necessary to recognise a valid stop condition. If ~he test in operation 354 is met then the flow is to operation 356, where it i~ determined whether the dial direction reversed based on pulse polarity. If 2~71~77 there was a direction reversal then the direction flag is set reversed from the prior direction. ~his iB
accomplished ~y the setting of a dlrection flag in the memory of the ~icroprocessor 44.

s This Pla~ will also be used ~y the microproce~sor 44 to control display 18 to ~how an arrow in the appropriate direction.

IP the result of operatlon 354 or operation 356 is in the negative, then the logic flow branches around the operation 358 and leaves the direction uneffected, resulting in any further input pulses ~rom dial 14 rotation changing the numbers di~played in the same direction ~increase or decrease) as they were being changed pr~or to the detect~ng of a ~top of the dial 14 for a time period insufficient to cause seversal recoynition. Accordln~ly, th~ use of a dialer to attack the lock 10 i5 again ~nterfered with and defeated.
~0 EXCESSIVE ER~OR LOCK OUT

If an attempt to unlock the lock 10 is made and the attempt is unsuccessful, the operator will attempt ~o unlock the lock 10 again and in all probabil~ty will be ~uccessful within a very few additional attempts if the MH9_9~-001 ` 2a7l~77 operator i5 in possession of the authorized combination.
However, if ~he operator is not ln possession of the authori~ed combina~ion and is trylng the lock in either a systematic or random manner, the microprocessor 44 will keep a count of the $ncorrect attempts to unlock the lock 10 and if the number of incorrect attempts exceeds a predetermined nu~ber ~f attempts, the lock may be eithex disabled from further attemp~s by blanking the di~play 18 or displaying an err~r signal to indlcate that the combination entered is erroneou~, for each ~ubsequent combination, notwith~tanding the entry o~ the correct authorized combination. This ~afeguard is incorporated in the software microcode contained in the memory of the microprocessor 44 and illustr~ted in the logic flow diagram in Fiq . lO~

Referring to Fig. 10, when the loc~ is powered by the rotation of the dial 14 and genera~or 29, ~s represented by operation 400. ~he numbers of the combination are 2Q allowed to b0 entered into the microprocessor 44 as represented by operation 402.

Thereafter, in operation 404, a check is made a~ ~o whether all numbers of the combination have been ~nter~ed and if the result is negative, the flow branches back to ~ust prior to operation 402, with the acceptance of the ` 2~71 ~77 remaining numbers of the combinatlon.

~he total try c~unt ~s the ~umber of unsuccessful attempts to open ~he lock since the last su~cessful attempt to open the lock lOo When the numbers of the combination have been entered, the answer to operation 404 is affirmative and the logic flow branches to oper~tion 406 w~ere the total try count ~s checked to find its value. In operation 406, ~he total ~ry coun~
is compared to a predetermined number such as 10 and if greater than or equal to 10, the microprocessor ls conditioned to siynal an error ~ymbol on the di~play 18 in operation 415. The LCD display 18 is then interdicted and is blanked to prevent displaying numbers or 5ymbols, thus e~fectively preventing the entry of any num~ers into the lock 10 in an e~fort to enter the combination.

The lock remains lnoperative until it is left unoperated for a period ~o bleed down the power ~tored internally.
Once the power of the capacltor is bled down, the power to the microprocessor 44 i9 insufficient ~o maintain the flags that are set to indicate that the lock 10 is disabled and the lock 10 becomes functional again. ~he preferred time period necessary for power-down is ~elected to ~e sufficiently long to be a source of 20711 ~77 irritant to an attacker~ but not 80 long as to be a major inconvienence to an authorized operator. A
preferred time period ~or power-down i~ 90 ~econds.

If the total try count is less than lo, for exa~ple, then the logic flow is directed by operation 406 to operation 408 where ~he combina~ion ~u~t entered is tested to determine the correctn~ss of ~he c~mbination.

When the com~ination is not correct, then the logic flow ls branched to operakion 410 and the total try count is incremented by one, reflec~in~ the latest unsuccessful attempt to unlock the lock 10. ~hereafter the mlcroprocessor 44 is signaled to csuse the displaying of an error ~ymbol on the display 18 ln operation 414 and then the flow returns to ~he ~a~n logic flow of ~he system.

Another embodiment would be that the signalin~ o~ an error in operation 414, as a result of a Ye result in ~peratlon 406, may set a flag in the memory of the microprocessor 44 which can be used ~y the microprocessor 44 ~o prevent the opening of the lock 10 even if a correct combination is entered. In this case, operation 415 would not exist. In this mode of operation the display 18 continues to display numbers and symbols MH9-9 1 -001, ~4 2 ~ 7 ~

as it continues to ~unction~ thereby suggesting to the operator that the lock is still working and capable of opening up~n the entry of the auth~rized csm~inatlon, notwithstanding the fact that the lock is cond~tloned to re~use ~o open after ~he ~enth consequtive erroneous att2m2t to open the lock.

When the combination compares correctly with the authorized combination o~ the lock 10 in operation 40~, the lock 10 is conditioned to open or ~-o chan~e the co~bination i~ the change key 60 is inserted into the ports ~2 o~ the microproces~or 44. Therea~ter the logic ~low st~p~.

VARIBLE INC~EMENTA~ION OF ~HE DISPLAY

To furthex foll and defeat the abllitie~ of a dialer, the lock 10 is provided with a ~cheme of varying the number of pulses of the generator 29 ~hat are re~uired to update the display 18 to cau~e it to d~splay the next smaller or larger number. The beneflt of this ~cheme is as the ~peed of rotation of he dial 14 of the lock 10 increases, the rate of change of the displayed numerals increases until the rate o~ change is set by the fastes rotational rate and then the relationsh~p of the rate of change of the displayed numbers to the number of pulses M~9-91-001, 2~7~37~

from the generator remain~ constant for the re~ain~er of that rotational mo~ement of the dial 14, until the dial stops, eYen i~ the rotat~onal ~peed o~ the ~ial ~lows durinq later sta~es of rotation. ~he efect i8 to reduce ~he correlat~o~ of the number change rate on the display 18 and the exten~ of ro~ation of the dial 14.

Flg. 12 is a flow dia~ram which represents the decisions made by the microprocessor 44 to determine the speed at which the dial 14 is being turned, which i~ then used to ~e~ rates at which the the numbers ~re changed.
Returning to Fig 2, the generator 29 outputs pulse~ on l~nes 38 and 40 which are out of phase. ~he out-of-phase relation is used to determine the direction of rotat$on of ~he dial 1~ and the magne~ic portion ~8 of the generator 29. The phase 1 line 38 conYey~ pulses which are used ~o tndicate rotationa~ displacement of the dial 1~. The ~enerator 29 is conf~gured ~uch that a full rotation of ~he dial will cause ~he generator 29 to create 120 pulses.

The pulses on the phase 1 line 38 are connect~d to an interrupt bit in the microprocessor 44. Accordin~ly, each pulse interrupts the m~croprocessor 44. The interrupts are used to start and stop timers and counters.

MH9-91-0~1 ` 2~7~77 Dial reversal is detected when ~even phase 1 pulses are detected and the polar~ty of at lea~t 6 o~ the phase 2 pulses ~re of the ~ame polarity. Thus when the dial is reversed, the polarity of the ~ir5t phase 2 pul~e to be recaived has been preceeded by ~ix phase 2 pul~es of the prior polari~y. As each succeediny phase 2 pulse i~
received the count of phase 2 pul~es of the new polarity increases until when the slxth phase 2 pul~e of the new ~ polarity ls detected, the voting scheme is satisfied and the new direction of rotation is de~ermined.
~he microprocessor 44 ~imes the interval between the phase 1 pulses and thereby detects the rotatlonal ~peed of ~he dial 14. The speed is not ~ampled until after seven phase 1 pulses have been receive~, to a~oid ~peed detection when the dial 14 is n~t be$ng turned enou~h to provide a reliable input. After fieven pulses have ~een received the six interpul~e times are culled by discarding the shortes~ and the longest and the mean of ~a the remaining times determined and used. This approach to filtering of values acts to filter out noi~e.

As each speed cr~teria is met in ascending order o~
speed, that speed indicator is set andretained for the remainder of the dial turn; while the peed indicator is not rQduced if the dial slow~ down during that dial 20~1~77 turn, ~he ~peed indicator may be increased as speed increases A further filter to eliminate spurious conditions which could lead to unreliable results is that the middle and hlgh speed indic~tors ~n the microprocessor 44 are locked ~ut or rendered inefect~-~e unless a~ least 10 phase 1 pulses have been detected by the microprocessor 44 since the last valid dial ~kop. ~hi~ flltering ~f the input~ insures that the midd~e and high ~peed opera~ion of the display 18 is prevented durin~ quick short burst ~urns of tha dial 10.

The Microprocessor 44 has within it a coun~ex that is dasignated as the comb~natlo~ counter, whi~h counts the numbers and the numbers are displayed on displ~y 18, as well as being availahle for the internal processi~g of the number for u~e in the combination. The combi~ation counter is incremented~decremented, based on the number of pul~s receiYed by ~he microprocessor 44. ~he number of pulses necessary vary based on the dial speed as decided by ~he voting ~cheme de~cribed above.

The preferrad and exemplary condition~ ~or changing the combination counter are presented tabularly below.

MH9-gl-001 2~7~ 577 SPEED CHART
SPE:ED FLAG TI~5E IN~ERVAL PULSES PER
BE~WEEN PULSES COMBINATION
MINIM~ COUNT

Lock out 2 . 57 msec 2 Hlgh 5.14 msec 2 ~iddle B . 56 msec 5 I.ow . 64 . 2 msec 3-13 Creep 220 msec 3-13 As can be seen from the table, the counter and the :lisplay is incremented by one unit for each flve pu1~6!s if the interpul~e time interval is less that 8 ~ 56 msec but more than 5 .14 msec and the middla speed ilag i s s~t ~

The loclc out f lag is set only during the actual opening ~ycle o~ ~he lock 10 ( turning the ~:lial ï4 ts~ retract the bolt 26 ~rom strike 56 ), tv inhib~t the b~lt 26 from bein5~ retracted if the dlal 14 15 turned too fast. I~
the bolt 26 1~ engaged wlth the bo~t retracter 50 when the slial is being turned too fast, physical ,damage to the lock mechanism may result.

The incrementinq 3f the com~ination counter i5 2~7~37~

accompli~hed for ~he first ~hree pulses of a turn in the low or oreep speed and then thereafter with each 13 pulses. ~his i9 to pro~lde the ~peratos ~ Y.1~ual feedbacX early in the operation at these speeds and then to slow the incrementing ~o ~he de~ired rate thereafter, for the same dial turn.

.
In the high speed mode or operation, all numbers are sent to the display 18. Due to the response time of the display and ~he ability of the human eye ~o receive and process images only at relatively slow ~peeds, it may appear that numbers are being skipped by ~he display l8.

For a better understanding of the logic operations necessary to oDntrol the apeed of the change of the comb~nation counter and di~play 18, reference is made to Fiy. 12. As the interpulse time peri~d ~ determined by the detection and votlng scheme described a~ove, the time value is compared in operation 450 to the time inter~al standard for the lock out mode, i.e., 2.57 msec, and if the interpulse tlme is le^cs than the standard, the lock out speed flag is set in operation 45~. If the time period is greater than the lock out speed mode time standard, the flow is from operation 450 to operation 454 where the interpulse t~me period ~
compared with the hi~h speed time standard of 5.14 msec MH9-9l-001 - 2~7~7~

and if the time interval is less than the hi~h speed t~me standard the flow branches to operation 456 where the high ~peed ~lag is set. Similarly, the interpulse time period is compaxed to the middle speed time 5 standard and ~he sl~w speed ~$me s~andar~ and ~he ~ppropriate ~peed flags se~.

The setting of a ~peed flag resul s when ~he ~low is diverted from the series of decision operations 450, 454, 458 and 462. The flow ls then thru flag sett~ng operations 452, 456, 460 and 4b4 as appropriate wi~h the resulting setting of all ~lags ~r speeds slower that the first satlsfied speed condition.

lS Referriny to operation 462, if the interpulse time interval is gxeater than 64.2 msec, then the only remaining choice of speeds i8 that o~ creep speed and the creep speed flag i set in operation 466. The flow from operation 464 or 466 is back to the main flow of 2~ the system.

As the dial 14 is turned the microprocessor 44 not only receives the pulses but after determining the speed at which the dial 14 is turning, ~hen must update or increment the combination counter. This is accomplished by the logic control operations represented by the flow MH9-91-001 .

2~7~77 dia~ram of Fig. 13.

As the pulse flow into the microprocessor 44 continues, the ~he $1ags of the microprocessor 44 are checked to ascerta~n if the direction has been de~ermined by the voting scheme ~s descrlbed abo~e. ~hi~ cleciæion aæ to whether the direction has bean decided i~; represented by operation 500, I~ the deci~ion on the dlrectisn of the dial 14 rotativn has not been made, it is premature to a~sess speed. This ~ 9 not done until direc~on has been determined, and the flow branches around all ~ther ~pera~ions ~f ~he subroutina and re~urns ~o the main flow of the system.

If, on the other hand, the direction has been determined, the ~low ~rom operation 500 i6 to operati~n 502 where the h~gh ~peed flag i8 checked. If the high speed flag is ~et, the microprocessor 44 is commanded to update the combinatlon countex by one unit for each two ~ulses received from the generator 29, as represented by operat~on ~04.

If the hl~h speed flag has not been set then the middle speed flag is tested to see if it has been set in operation 506. When the middle speed flag has been set, as determined in operation 506, the combination counter 2~7~7 is updated by one unit for each five pulses a~
represented ~y operation 508.

Similarly, if the flag for the middle speed i~ not ~et, a dec~slon in operation ~10, ~ made as to whether this is the initial dial rotation at a low ~peed in this dial turn. If thi~ decision operation re~ults in a negative determination, then the dial 14 h~s been rotated at a low ~peed previously ln this dial ~urn and the ~0 co~bination counter is lncremented ~y one unit for each 13 pul~es generated by ~he generator 29, as represented by operation 512.

When the result of operation 510 i~ in the affirmative, 1.
the ~low is to operation 514 where the combination counter ls upda~ed by one unit for each 3 pul~es received by the microprocessor 44.

FQ110Wing ths updating of the combination counter, in ~0 response to any of the speed flag~ ~et or not s~t, the control reverts back to the main logic control of the lock 10.

BACKUP FEATURE

The backup feature i~ important in that it gives the 2071~77 operator a way to xeco~er from an erroneou~ly dialed number if ~he number has n~t been entered and i~ the dialed number is less than 3 from targ2t number. ~he feature d~es no cvmpromise the security of the lock since the operation of the lock ls to back up the number by ~our units upon any dial re~ersal. Thu~, the backing up of the displayed numbers on the display 18 does not indiGate to the attacker ~hat he has ~pproached a combination number, si w e any xeversal of the dial at any number will result ~n the four unit backup o~ the displayed numbexr Progressing pa~ the backed up value and continuing the reversal movement enters the value of the number in th~ combination counter and on the display 18 when the reversal occurred, as a combination number lS f~r later c~mparis~n. The backup ~eatur~ $~ operational on all dial reversal~

When dialing the combination, the operator may turn the . dial 14 too far and pass the tar~et number of ~he combination. While the dial may be turned additional revolutions and the tar~et number selected and disp~ayed, the preferred embodlment of the lock ~ to perm~t the opera~-or to reverse the dial direction for a short displacement with the numbers displayed and contained in the combination coun~er changed to a number four units displaced for the number displayed prior to . 2~71577 backing up. After the numbers have ~acked up by four units, the dial 14 may then be turned in the direction that it was originally be~n~ turned, to again approach the target number of the comb~nation. ~he logic control of this function is illustrated in Fig. 11.

When a number has been d~aled and the di~l 14 is stopped, the period of the stop is checked to determine if the stop time ~s at least 2Z0 msec ln operation 550;
and i~ not, the ~top i~ no~ recognized and the flow br~nches ~round other operations in the subroutine to operation 560, where the combination counter and the display 18 are changed by one u~it.

On the other hand, if the stop time does exceed ~20 m~ec then the stop ls recognized as a valid dial stop, and the flow is directad to opera~ion 5~2 where a ~eci~ion is made as to whe~her the dial reversed direction. If ther~ is no reversal of direct~on, therP i5 no need ~o consider the backing of the di~played numbers and the contents of the combination counter. Accordingly, the branch i9 to operation 560, as described above, and there is no effort to rever~e the count and the ~urther rstation is an attempt to reach a nu~ber as yet not accessed.

20~1577 I f t:he directlon of the ~ial 14 rotation is reversed, then a f1ag called the baclcup switch is checked to ascertain if i~ is turned on~ If this backup ~witch i~
on in operation 554, it indlcates that $he backup 5 proe~ess i~ underway and the latest rever~al of the dial 14 is preparatory to the resumption s:~f the operation of the dial 14 ~o dial the target number of the combination. ~n this instance, there is no ne~d to backup tlle nulTbers and, accordingly, the backup 6wi~ch 10 i s reset in operation 556, prior to changin~ the number os~ the clisplay 18 and in the combina~ion ~ounter by oxle, at op~ration 560.

2~

MH9-91_001.

2~7~77 When the ~tatus of the bacXup switch is tested in operation 554, if the status is off, then the flow Is to op2ration 558. In operation 558, ~he number i~ changed by 3 and the baGkup witch is ~et. The ~inding in operation 554 that the backup swi~ch was not on indicates that the dial 14 was turned but, had not previously been reverse rotated; therefore, the reversal of ~he dial 14 should 1nvoke the backing up o~ the numbers.

Thereafter, the flow ~rom operations 5~6 or 558 i~ ~o operat~on 560 where the number i8 changed by one unit.
The ne~ effect is t~at the numbers displayed are changed by 4.

ERROR AND SEAL COU~TERS

Referring to Fiq. 15, ~he operation of the ~eal and error counters and the display of their contents will be described.

When the lock 10 is powered on, in operation 600, the clockwi~e rotation o~ the dial 14 is checked for, at operation 602. If ~he rotation of the dial 14 i9 counter-clockwise, then the flow is branched around other operations to operation 608. However, if the MH9-91-001.

~07~ ~77 rotation is clockwise, the flow is to operation 604 where the seal counter contents are displayed on the dial 18. ~he seal counter counts the number of times that the lQck has been opened 6ucessfully.

After the contents of the ~eal counter have been displayed on the display 18, if there i~ a clockwi~e turn of ~he dial 14, the logic control f:Low branches and loops bacX to ~us~ prior to the di6play operatlon 6Q4.
When the ro~ation of the dial 14 is cou~er-clockwise, as detected in operation 606, the error counter ~s checked to ascertain if the value ~tored therein i~
three or more, in operation 608~ If the value in the error counter is three or larger, then the error counter contents are displayed in operation 610. ~he displayed number ls the count o~ times that the lock 10 has been dialed ~or access without ~uccessfully opening it or when one of the security ~eatures has blocked the lock 10 from opening. The count i~ from the la~t ~uccessful opening of the lock 10.

Two turns in the counter-clockwise direction will resul~
in the continued display of the error counter content~, as illustrated in operation 612. Two turns in the clockwise direction will branch to vperation 614 where the combination for the lock ls allowed to be entered.

6~

. 2Q7~577 After entry of the combination, operation 616 does a ~ompare of the entered combinatlon and the authorized combination and lf $hey compare true, the lock ls condit~oned to unlock in operation 6180 Since the error counter only accumulates the count of erxoneous entry ~ttempts since the la t ~;uccessful openi~g of ~he lock 10, with ~he ~ompare true on the combination, the error counter is re~et as in operation 620. S$milarly, the seal coun~er counts successful combination entries, and the seal coun~er is updated by incremen ing its contents by one unit, a~ in operatlon 622.

Should the combination not compare true in operation 616, the error counter is incremented one unit in opera~ion 624 to reflect the erroneous entry at~empt.
Af~er the incrementin~ of the seal or error counters, the routine ends and the lock awai~s any further input by the operator. As discussed earlier, if left unattended for a su~icient amount o time, the lock will power down.

The combinati~n ~f the error and seal counter~ provide a reliable, easily accessed, easily understood indication that the lock has been operated; and if the numbers are MH9-91-001 .

2 0 7 ~ :~ 7 7 dif ~eren~, indicate either ~ailuxe or succesæ by th~
attacker .

LOST C:OMBINATION RESETTI~;

~he serial numbex of the loclc may be usecl a~ ~ temporary combination to open the lock and thus allow the setting of a new combina~ion. This allows ~or clrcumstahces where locks sre placed in inventory and records of 10 combirl2ltiolls are misplaced or memories lapse and no one reTnembers the combinat~on of an 1nventory loc~c.

Referrl ng to Fig . 14, to open the lock so ~hat ~he normal change com~ination proc:edure may ~hen be used, 15 the change Icey 60 is ~J~se~ ed in ~ha lock 10. The lock 10, when p~wered c>n, c~peratiorl ~50, will detect the presence of the chan~e key 60 in ports 62 of the microprocessor 44, in operation 652.

20 If the change 3cey 60 i5 detected, ~he ~pen flag in the memory of th2 microprocessor 44 is checked in opexatior 654. If the open iEla~ is on, the serial number i~ not allowed by operat~on 656 as a com~lnation, because the lock is open and was presumably opened with a correct and known comb~nation. ~Iowever if the open flag or bit i~ not on, lndicatlng that the lock lû is locked, then 20~7~

the 1Ock 10 is conditioned to accept he serial numbex of the lock 10 as a ~ubstitute combination, in operatio~ !
658. This may be accomp1ished by the ~etting of a f1ag which then a11Ows the comparing of the ~erial number 5 which is stored in a memory a~soclated w.Lth microprocessor 44, with the entered comb:Lnation, rather than comparing the authorized combination.

When the change ~ey ~0 is not tn the lock 10, as ascertained in operation 65~, the open bit is reset in operation 660, and the combination entered ~ compared with th~ authorized combination in operation 662; if good, the lock is unlocked and the open bit i~ ~et in operation ~64. If the combination i~ not good the logic flow branches back to the beginning of the routine ~o await further input.

~his scheme does not compromise the ~ecurity of khe 1Ock ~ince the 1Ock must be accessible for the insertion of the chanqe key while the lock is locked, i.e., when the combina~ion is ~crambled and the open bit is re~et.
This prevents ~he covert ~nsertion of ~he change key 60 when a safe or vault is open and the return at a later time to open the safe or vault 12 w$th ~he combination that miqht be changed using the serial number ~f the lock.

~9-91-001 .

~7~377 The insertion of the change key 60 into ~he ports 62 creates a con~it~on that prevents the xesetting of the open bi~. ~s ~een from opera~lons 654 and 658, the open S bit must be reset for the serial number to be allowed in lieu of the au~horized combination ~n the combination change procedure.

LOCX DISABLEMENT ~ND RECOVERY
Referring to Fig. 2~, there is ~hown a fea~ure in log:Lc form, where if the error counter is incremented to a number larger than that concieveably needed for an individual with an authorized combinat~on to operate the lock, such as 50 ~ime, the lock can be di~abled. To accomplish this a check of ~he error counter is cone in operation 1200, where the error count is compared ~o the number, Por example 50. If the number is not greater than 50 the flow would return. However, if ~he number is greater ~h~n 50 the lock out ~lag ls set in permanent memory at operation 120~ and then return. ~his flow cou~d, if desired~ be in~erted in the ~low of ~ig. 18, between operations 868 and 9~2 at ~.

Once the lock out flag i~ provided and the flow in Fig.
22 is incorporated into the flow of Fig. 18, the flow of ~71 ~77 Flg. 23 may be inserted into the routine shown in Figl lB, between operations ~5B and 962, at B.

If thLs embodiment is incorporated ~nto the fl~w v~ Fig.
18, then when the decision ~n operation 9S8 is negative, ~he lockou~ flag 15 checked ln operation 1~50 and i no~
ON, the ~low returns to B and con~inues. However, if the lock out flag is ON the microprocessor checks to see if the combination entered is he third consecutive correct comblnation ent~y in opera~ion 1252. I~ so, the lock out $1ag ls r~set at operatlon 1254 and ~he flow i~
to return a~ the combination is not ~he third consecutive correct combination entry, an arror i~
s~gnaled in operation 1256, the same as described in operation 9~0 of Fig O ~8, and tha flow i~ to restar~
en~ry 862, Fig. 3.

If desired, operations 1252 and 1254 may be omitted from the ~low of Fig. 23. When this occurrs, the lock cannot be reset and the lock must be drilled and replaced, ~ince the f low of Fig. 23, without operations 1252 and 1254 results ln the lock bein~ permanently disabled with no way of recovery.

~he foregoing routines that implement the functions and features operate within the system operations vf the MH9-gl-001 lock as is represented in Figure 3 ~nd the Figures referred to from Fig. 3.

Th~ pre~erred embodiment o~ this invention is to implement all the control operat~ons and hence the ~unctions and operational features of the lock 10 in microcode in a microproçesser 44 of the t~pe sold by OXI
Electric Industries Company, Ltd., under the designation 80C51F. Other microprocessors by o~her manufac~urers may be substi~uted Por ~he preferred devlce so lon~ as ~he characteristics of the substituted device meet the needs of the lock 10.

~he control of the microprocessor 44 is by microcode which is wri~ten according to the constraints defined by the device manufact~rer and which are readily available from ~-he dev~ce m~nufac~urer of choice. Any skilled ~ode writer may code the microcode, yiven a program listing. ~he program listing may ~e prepared for the the device of choice, foll~wing the constra~nts required by the particular microprocessor device chosen. ~he lo~ic and operational flow diagrams con~ained in Figs.

3 -23 are applicable to any microprocessor and accordingly, teach one of skill in programming the 2~ necessary operations to operate the lock. ~he organization of the log~c flows is exemplary and may be MHg-91-001 .

- 2~7~577 modi f ied according to ~he des ires of the programmer and code writer.

The foregoing ~ s the pr~ferred embodimen~ of the 5 invention. It is recogni zed that changes and modifications may be made to the embodimen~ of the lnvention without departing Irom the ~cope and the 6pirit of the invention and such ch2mges and modi~ications reside wit~in ~he scope of the claims 10 ~elow:

We claim:

~0

Claims (33)

1. An electronic combination lock comprising a dial means for inputting combination elements;
generator means driven by said dial means for powering said electronic lock and for converting said inputting of said combination elements into electical pulses;
microprocessor means for receiving said pulses and for utilizing said pulses received to control the operation of said microprocessor;
display means for displaying to an operator numbers to be incremented and decremented to enter numerical elements of the combination into the lock;
said lock further comprising means for timing the period from the time said microprocessor is activated until said combination has been entered;
means for storing a value defining a predetermined time period selected as the combination may be entered into said lock;
means for comparing said period to said predetermined time period; and means responsive to said means for comparing to condition said lock to not unlock when said period is less than said predetermined time period.

2. The electronic combination lock of claim 1, where in said means for timing comprises a timer started when the said microprocessor is supplied sufficient power to operate.

3. The lock of claim 2 wherein said predetermined time period is less than the time normally required to open said lock manually.

4. The lock of claim 1 wherein said lock further comprises means for signaling an erroneous condition exists when said lock is attempted to be opened in a period of less than said predetermined period.

5. An electronic combination lock comprising a dial means for inputting combination elements;
generator means driven by said dial means for powering said electronic lock and for converting said inputting of said combination elements into electrical signals;
microprocessor means for receiving said signals and for utilizing said signals to control the operation of said microprocessor;
display means for displaying, to an operator, numbers to be incremented and decremented to enter numerical elements of the combination into the lock;
said microprocessor further comprising means for timing the period from the time said microprocessor is activated until said combination has been entered;
means for storing a value defining a predetermined time period selected as the longest acceptable time period within which said combination may be entered into said lock;
means for comparing said period to said predetermined time period; and means responsive to said means for comparing to condition said lock to not unlock when said period is greater than said predetermined time period.

6. The electronic combination lock of claim 5 wherein said signals are electrical pulses.

7. The electronic combination lock of claim 5, wherein said means for timing comprises a timer started when the said microprocessor is supplied sufficient power to operate.

8. The lock of claim 5 wherein said predetermined time period is greater than the time normally required to open said lock manually.

9. The lock of claim 7 wherein said period is sufficient to allow a human being to enter said combination a plurality of times.

10. The lock of claim 5 wherein said lock further comprises means for signaling an erroneous condition exists when said lock is attempted to be opened by operation of said dial means which has extended over a period greater than said predetermined period, without said lock being opened or denied power by non, operation for a period to render said lock powered down.

8.

11. The electronic combination lock of claim 10, wherein said means for timing comprises a timer started when the said microprocessor is supplied sufficient power to operate.

12. An electronic combination lock comprising a dial means for inputting combination elements;
generator means driven by said dial means for powering said electronic lock and for converting said inputting of said combination elements into electical signals;
microprocessor means for receiving said signals and for utilizing said signals to control the operation of said microprocessor;
display means for displaying to an operator numbers to be incremented and decremented to enter numerical elements of the combination into the lock;
means for storing data representing a predetermined amount of turn of said dial;
said microprocessor further comprising means for correllating said signals with movement of said dial means;
means for detecting when said dial has stopped turning;
means for determining the extent of the turn of said dial completed since said dial was last stopped;

and means for comparing said extent of the turn of said dial with said predetermined extent of turn of said dial.

13. The electronic lock of claim 12, wherein said microprocessor further comprises means, responsive to said means for comparing, for creating a signal for prevent said lock from opening when said comparision result is that said extent of said turn of said dial exceeds said predetermined extent of the turn of said dial stored in said means for storing.

14. The electronic lock of claim 14 wherein said predetermined extent of the turn of said dial is an amount that exceeds the rotation of said dial during any single grasp of said dial by a human hand.

15. The electronic combination lock of claim 12 wherein said signals are electrical pulses.

16. An electronic combination lock comprising a dial means for inputting combination elements;
generator means driven by said dial means for powering said electronic lock and for converting said inputting of said combination elements into electrical pulses;
microprocessor means for receiving said pulses and for utilizing said pulses to control the operation of said microprocessor;
display means for displaying, to an operator, numbers to be incremented and decremented to enter numerical elements of the combination into the lock;
said microprocessor further comprising means for determining the duration of any period during the time said which said microprocessor fails to receive any of said pulses;
means for determining the direction of rotation of said dial;
means, responsive to said means for determining direction of rotation of said dail, for determining a reversal of direction of rotation of said dial;
means for storing a value defining a predetermined time period selected as the shortest acceptable time period that said microprocessor may not receive any of said pulses for said reversal of said direction of said dial to be recognized;
means for comparing said duration with said predetermined time period.

17. The electronic lock of claim 16 wherein said lock further comprises means responsive to said means for comparing for inhibiting recognition of said stop when said duration is less than said pedetermined time period.

18. The electronic lock of claim 16 wherein said lock further comprises a means, responsive to said reversal of said dial when said duration is less than said predetermined time period.

19. The electronic lock of claim 17 wherein said lock further comprises a second means responsive to said means for comparing, for inhibiting recognition of said reversal of said dial when said duration is less than said predetermined time period.

20. The electronic lock of claim 16 wherein said lock further comprises means responsive to said means for comparing, to recognise said stop only when said duration is greater than said pedetermined time period.

21. The electronic lock of claim 16 wherein said lock further comprises a means, responsive to said means for comparing, for recognizing said reversal of said dial only when said duration is greater than said predetermined time period.

22. The electronic lock of claim 20 wherein said lock further comprises a second means, responsive to said means for comparing, for recognizing said reversal of said dial only when said duration is greater than said predetermined time period.

23. The electronic combination lock comprising a dial means for inputting combination elements;
generator means driven by said dial means for powering said electronic lock and for converting said inputting of said combination elements into electical singals;
microprocessor means for receiving said signals and for utilizing said signals for controlling the operation of said microprocessor;
display means for displaying, to an operator, numbers to be incremented and decremented to enter numerical elements of the combination into the lock;
means for storing an authorized combination for said lock;
means for comparing a combination entered through rotation of said dial means with said authorized combination;
means, responsive to said means for comparing, for determining a condition of failure to compare of the authorized combination and said entered combination;
means for counting the number of failed attempts to enter said entered combination and compare indentically with said authorized combination, since the last successful unlocking of said lock;
means to store a predetermined number;
means to compare said count of said failed attempts with said predetermined number; and means for signaling an error when said count equals or exceeds said predetermined number.

24. The electronic lock of claim 23 wherein said display means further displays symbols to said operator and display means is further responsive to said means to signal an error to display a symbol to provide said operator with an indication of an error in the operation of said lock.

25. The electronic lock of claim 23 wherein said lock comprises means responsive to said means for signaling for inhibiting opening of said lock from the time of said signal until said lock has been rendered inoperative due to lack of sufficient electrical power to operate said microprocessor.

26. The electronic lock of claim 23 wherein said lock comprises means responsive to said means for signaling to inhibit the operation of said display, thereby rendering said lock inoperable.

27. The electronic lock of claim 23 wherein said lock comprises means for generating an electrical signal for rendering said lock unopenable; and means for storing said electrical signal for rendering said lock unopenable.

28. The electronic lock of claim 27 wherein said lock further comprises means for reading and checking said means for storing to detect the presence of said signal signal enabling said lock to open from being generated for reading and checking.

29. The electronic lock of claim 27 wherein said lock further comprises means responsive to said means for comparing, for accepting a predetermined plurality of consecutive determinations of lack of failure to compare;
reset means responsive to means for accepting, to reset said stored electrical signal, whereby said disability of said lock is removed upon the entry of said correct combination a said predetermined plurality of times for the said consecutive determinations.

30. An electronic combination lock comprising a dial for rotation;
a generator for generating electrical pulses in relation to said dial, and responsive to said dial rotation to generate said pulses;
electonic control means responsive to said pulses for determining rotation of said dial;
said electronic control means further responsive to said pulses for correlating said pulses with said rotation of said dial;
counter means for maintaining a count representive of numbers being entered as a portion of a combination to said lock;
said electronic control means further comprising means for incrementing or decrementing said contents of said counter in response to said pulses;
display means responsive to said electronic control means for displaying numbers contained in said counter means and symbols;
means for detecting a reversal of said dial rotation;
means responsive to said means for detecting a reversal for changing said count of said counter means by a predetermined quantity in a sense opposite that said counter had previously been incrementing or decrementing, whereby said counter means and said display are conditioned to permit a further dial reversal and incrementing or decrementing of said counter contents by single units upon dial rotation in the same direction as previously rotated, prior to said first reversal.

31. An electronic combination lock comprising a dial means for inputting combination elements;
generator means driven by said dial means for powering said electronic lock and for converting said inputting of said combination elements into electical singals;
microprocessor means for receiving said signals and for utilizing said signals for controlling the operation of said microprocessor;
display means for displaying, to an operator, numbers to be incremented and decremented to enter numerical elements of the combination into the lock;
means for storing an authorized combination for said lock;
means for comparing a combination entered through rotation of said dial means with said authorized combination;
means, responsive to said means for comparing, for determining a condition of failure to compare of the authorized combination and said entered combination;

means for counting the number of failed attempts to enter said entered combination and compare indentically with said authorized combination, since the last successful unlocking of said lock; and means for displaying the value of said number, thereby providing an indication to said operator of said number of erroneous attempts to open said lock since a last successful opening.

32. The electonic lock of claim 31 further comprising decision means for determining if said number exceed a predetermined number; and means responsive to said decision means for displaying said number when said decision means determines said number exceeds said predetermined number.

33. An electronic combination lock comprising a dial means for inputting combination elements;
generator means driven by said dial means for powering said electronic lock and for converting said inputting of said combination elements into electical singals;
microprocessor means for receiving said signals and for utilizing said signals for controlling the operation of said microprocessor;

display means for displaying, to an operator, numbers to be incremented and decremented to enter numerical elements of the combination into the lock;
means for storing an authorized combination for said lock;
means for comparing a combination entered through rotation of said dial means with said authorized combination;
determining means, responsive to said means for comparing, upon determination of a condition of success in comparing said entered combination with said authorized combination;
means responsive to said determining means for incrementing said count; and means for displaying said count to said operator, whereby said operator may be made aware of a number from which said operator may determine whether said lock has been unlock since the last time said number was displayed to said operator.