Circuit for Controlling Automatic Off-Line Operation of an on-Line Card Reader

This invention relates to static magnetic card readers used in systems for controlling access through electrically operable devices, such as doors, turnstiles, printers, etc. More specifically, this invention relates to a system wherein access at plural remote locations is controlled by a central processor and in which limited access is available even when there is a failure in communication lines between remote terminals and the central processor.

In systems in which encoded data on a card or badge are used for controlling access, the card or badge is typically inserted in a slot of a reader, which reads and decodes the encoded data on the card. Advantageously, the data is encoded as a plurality of magnetically polarized spots in a strip of magnetic material. Such encoded data normally includes an identification number or numbers identifying the card holder. During use, this number encoded by the card is compared with a number or numbers stored in the central computer terminal to ascertain whether the individual inserting the card is entitled to access to a building, room, parking lot, or the like. Such cards may also include a secondary set of encoded data which is used when a communication failure between the remote terminal and the central terminal is sensed. Such secondary encoded data typically screens card holders on a different basis than does the central computer terminal, and often allows access to a wider range of personnel, but nevertheless restricts access to a selected group.

In one prior art embodiment the magnetically polarized spots are used to directly actuate a reed relay or other moving switch mechanism located within the reader. The state of the art system is exemplified by U.S. Pat. No. 3,686,479 entitled Static Reader System for Magnetic Cards, assigned to A-T-O Inc., assignee of the present invention, employing electromagnetic solid state sensors disclosed and claimed in U.S. Pat. No. 3,717,749, also assigned to A-T-O Inc. Such systems have been found to be very reliable and are in use as access control systems in a number of different industries, universities, and government installations.

The state of the art in regard to operation of such systems in the event of communication line problems is disclosed and claimed in U.S. Pat. No. 4,004,134, also assigned to A-T-O Inc. Each of the above-referenced patents is hereby incorporated in the present application by the reference.

The system disclosed and claimed in U.S. Pat. No. 4,004,134 incorporates a central processor which periodically and sequentially polls each of the remote terminals in the system. The remote terminals are enabled to transfer data to the central processor only on receipt of a polling pulse. Each of the remote terminals includes a timing system which measures the time between receipt of successive polling signals at that remote terminal from the central processor. If an extended period of time elapses between successive polling pulses, that patent discloses a system for automatically placing the remote terminal in a degraded mode of operation in which a secondary set of card data is read and interpreted to control access at that remote terminal.

While this prior art system has substantial advantage in permitting access during faults in the operation of the system, it will only monitor failures in the polling system or polling communication lines. If the polling system and its communication lines are complete and operating in a normal manner, the degraded mode will not be activated. Thus, if a failure occurs, for example, in the ability of the remote terminal to transmit coded data to the central terminal in response to polling pulses, if a failure occurs in the data transmission lines from the remote terminal to the central processor, or if failures occur in the ability of the central processor to respond with a signal granting or denying access in response to the data from the remote terminal, the system of that patent would not be placed in a degraded mode and the remote terminal would become inoperative. Such an inoperative terminal may even be dangerous in certain circumstances, such as during an emergency, since access through a door might be impossible.

Utilizing the system of the U.S. Pat. No. 4,004,134, furthermore, if a problem existed in the data communication lines or in other systems which did not affect the operation of the polling sequence, a person inserting a card at the remote terminal which should provide access will recognize that the system is not operating. Once individuals at remote terminals can become informed of a non-operational status of the security equipment, the security of the entire system is endangered. Under these circumstances, modifications may be made to a non-working remote terminal by persons wishing to continue future clandestine entry at the remote location.

The present invention provides a substantial improvement over the system disclosed and claimed in U.S. Pat. No. 4,004,134, and alleviates most of the problems associated with that system in order to provide a card sensing access control system which automatically enters a degraded mode of operation whenever failures occur in any communication lines, or in virtually any part of the central processor or remote terminal. This is accomplished by sensing the insertion of a card at the remote terminal and monitoring the incoming data line for a coded signal specifically granting or denying access to the card holder. in order for such signal to be transmitted to the remote terminal, virtually the entire security system must be operating correctly.

If no signal which specifically authorizes or denies access is received within a predetermined time after card insertion, which time period is calculated to be sufficient to permit such a signal to be transmitted even when the system is operating at its busiest level, the system automatically enters a degraded mode. The degraded mode then permits monitoring of secondary data on the user's card for controlling access at the remote terminal.

More specifically, the remote terminal, after measuring a predetermined time period following the insertion of a data card and without receipt of coded signals granting or denying access, activates a card reader for reading the secondary degraded mode data on the inserted card. If this secondary data matches data stored in a buffer and used for determining who shall have access during degraded mode operation, the system activates a code generator within the remote terminal which transmits directly to the remote terminal logic input line an entry authorization code. This code is identical to that which is normally transmitted by the central terminal to the remote terminal and is thus interpreted by the remote terminal as an authorization code so that entry is permitted.

These and other advantages of the present invention are best understood through the following detailed description of the preferred embodiment which references the drawings, in which:

FIG. 1 is a schematic block diagram of a system incorporating the present invention; and

FIG. 2 is a schematic block diagram of an alternate system showing the preferred embodiment of the present invention, that alternate system utilizing a computer program which is disclosed in this application.

Referring to FIG. 1, it should initially be noted that the circuit of that figure includes, in addition to those elements which permit improved degraded mode performance, the elements disclosed in U.S. Pat. No. 4,004,134. These latter elements, as well as their operation, will be briefly described first, although reference to that patent should be made for a detailed understanding of that portion of FIG. 1.

A magnetically encoded card 11 is provided for insertion by a person wishing to gain access at the remote terminal shown in FIG. 1. The card 11 is inserted into a housing (not shown) within which are a plurality of sensors. The card 11 is spot magnetized so that the poles of all spots are perpendicular to the card faces, and when the card is fully inserted in the housing, each such spot is coaxial with a respective sensor. Sensors employed preferably are the type having a coil wound on a core of saturable material of high initial permeability requiring a sufficiently low magnetomotive force to saturate it that the spot of a card will affect such saturation. See U.S. Pat. Nos. 3,686,479 and 3,717,749, assigned to the same assignee as the present application.

When a voltage pulse is applied to such a coil, the decay thereof is slower in the presence of an opposing spot field than the decay of a pulse in the presence of an adding field. By way of logic devices coupled to the coils, respective binary logic level outputs are derived for the aiding and opposing relationships.

In the drawing, two sets of sensors labeled On-Line Sensors 13 and Off-Line Sensors 15 are shown. Each sensor has one end of its coils connected to a voltage source and the other end of the coils are adapted to be connected to a point of reference or ground potential in a sequence as determined by decoder or switching circuitry to which they are connected. In this regard, when the card 11 is fully inserted in the housing, the inner end of the card actuates a moveable contact of a switch 17 to indicate that the card is in place in the housing. A connection 19 from the switch 17 enables a pair of buffers 21 and 23 so that, once the card 11 is fully inserted and the switch 17 is activated, data from the sensors 13 and 15 is strobed into the buffers 21 and 23 where this data is stored for future use.

The buffer 21 is connected to a data reader and transfer network 25 which is adapted to transfer the data in the buffer 21 to a central processor or terminal, usually in a serial coded fashion, on data line 27. It will be understood, of course, that multiple remote terminals such as that shown in FIG. 1 exist in the overall security system, and each of these remote terminals is connected by means of a data line 27 to the central terminal. When a card 11 is inserted into the remote terminal and the switch 17 is closed by the card, the signal on line 19 enables the buffer 21 and in turn enables the data reader and transfer network 25, so long as an enable signal is present on line 29, as will be explained in more detail below. In response to these enabling signals, the data reader and transfer network 25 transmits the data from the on-line sensors 13 to the central terminal.

As mentioned above, the central terminal is directly coupled to each of a plurality of remote terminals, each constructed as shown in FIG. 1, and repeatedly transmits polling pulses to these remote terminals in succession. Each such polling pulse conditions a particular remote terminal to transfer to the central terminal any data being read from a card that is in place. If there is no card in place so that no data is being read by the sensors 11 and 15, the polling pulse terminates and the next remote terminal in sequence is polled. If a card is in place, the first polling pulse occurring after actuation of the switch 17 will enable the remote terminal to transmit data to the central processor.

All signals received from the central processor, including polling signals, are clocked into a shift register 33 by a self-clocking connection 35 in typical fashion, and are automatically compared in a comparator 37 with a data word stored in a polling buffer 39. The buffer 39 contains the proper polling command for this remote network. If the signal received on line 31 is a polling command for the remote terminal shown in FIG. 1, an output signal will be provided by the comparator 37 indicating the identity between the signal and the word stored in the buffer 39. The signal on line 37 starts a fifty-second timing period of a timer 41. Successive polling inquiries from the central terminal are expected to be received on line 31 at more frequent intervals than fifty seconds and thus the fifty-second timer will be initiated by a new signal on line 37 successively, over and over again, at periods of time shorter than fifty seconds, so that the timer 41 will never time out. If a polling signal is not received within the fifty-second time period, indicating a failure in the polling system, the timer 41 will time out, setting a flip-flop 43 by means of a signal on line 45. The flip-flop 43, in its set condition will, in turn, enable a comparator 45 to make a comparison between the degraded mode or off-line data from sensors 15 stored in the buffer 23 and data permanently stored in a buffer 47 defining that group of personnel which will be granted access during degraded mode operation.

Once a polling signal is again received from the central terminal, a signal on line 37 will again start the timer 41 and, by means of line 49, will reset the flip-flop 43 to place the system in a normal operation mode by deactivating the comparator 45.

Once activated, the comparator 45 will output a signal on line 51 if the card 11, as read by the sensor 15, compares identically with the data in the buffer 47. The signal on line 51 will begin a 0.7-second delay introduced by a timer 53 and will thereafter enable a code generator 55 which provides on line 57 a code identical to the access authorization code expected from the central terminal on line 31. Thus, the line 57 is connected directly to the line 31, and data from the generator 55 will be clocked into a shift register 59 through a self-clocking connection 61. Once in the shift register 59, this command data will be compared in a comparator 63 with data permanently stored in a buffer 65. The data in the buffer 65 is identical to the access authorization code, and thus the code from line 57 will produce a signal on line 67 indicating that access is to be permitted.

It will be understood, of course, that if the system is operating normally, data transferred to the central terminal from the data reader and transfer network 25 will produce a signal authorizing access if the holder of the particular card 11 is to be permitted access at this remote terminal. This authorization signal will be communicated from the central processor on line 31 to the shift register 59 in the same manner as the signal on the line 57. Thus, the remote terminal of FIG. 1 cannot differentiate at this point between an actual authorization signal and an authorization signal generated by the degraded mode sensor 15, and provides a signal on line 67 which operates a driver and relay network 69 providing a mechanical or electrical output to give access at the access apparatus 71 (such as a solenoid operated door strike).

The system thus far described is substantially identical to that described and claimed in U.S. Pat. No. 4,004,134. It will be seen that the described portion of FIG. 1 monitors for successive polling pulses and will place the system in a degraded mode operation, utilizing the sensor 15, if successive polling pulses are not received. Failure in the line 27, or failure of the central terminal to properly respond to data from the data reader and transfer network 25 will not, however, activate that portion of the system, and degraded mode operation will not be initiated in response to such failures. It should be noted that the 0.7-second delay introduced by the time 53 assures that the person inserting the card 11 cannot tell that the system is in degraded mode. Thus, under normal operation, it takes a predetermined period of time for the apparatus to be polled, to transmit its data from the unit 25, to receive data on line 31, to compare this data in the comparator 63, and to provide access at the access apparatus 71. This same time is simulated by the delay timer 53 so that, even in degraded mode, a 0.7-second time period will elapse between insertion of the user's card 11 and access. Thus, if the user was among the group to be granted access during normal operation, he cannot determine whether the system is in its normal or degraded mode.

While the delay introduced by the timer 53 is described as 0.7 seconds, it should be understood that this delay may be any length sufficient to mask (to the user) the fact that communication failure has occurred. Furthermore, in the computerized embodiment described at the end of this specification, this delay is 50 milliseconds.

The apparatus added to the system of FIG. 1 by the present invention permits a more thorough monitoring of the overall system operation, including a monitoring of the line 27 as well as most of the system components, to place the system in a degraded mode when any portion of the system fails. The operation of this improved apparatus is based upon a requirement that, in response to insertion of card 11 into the system, a specific signal authorizing or denying access at this remote terminal must be received on the line 31 within a predetermined period of time. If no such signal is received in response to a card insertion, the degraded mode is automatically entered. The system thus monitors the entire security system by looking at the initial event, that is, the insertion of the card 11, and the final expected event, that is, the receipt of an authorization code on the line 31, and provides a predetermined time period during which this entire sequence must occur under the most unfavorable circumstances (that is, when the system is at its busiest level, due to communication from plural remote terminals). Failure in any portion of the system will thus activate the degraded mode and permit access to a user on the assumption that a portion of the security system is not properly functioning.

Specifically, insertion of a card 11 closes the switch 17 which, by means of line 73, initiates a 10-second timer 75. This timer 75 sets the predetermined time period during which a response must be received after the card 17 is inserted. If the timer 75 times out, that is, if 10 seconds elapses after receipt of the signal on line 73, the timer 75 will produce a signal on line 77 setting a flip-flop 79. The flip-flop 79, when set, provides a signal on line 81 which energizes the code generator 55 to provide an access authorization signal as previously described. It will be noted that 0.7-second delay network 53 has been bypassed in this circumstance, since a delay has already been introduced by the 10-second timer 75. Thus, the 10-second timer 75 masks the fact that a degraded mode operation is being undertaken by the system.

Receipt of a signal from the central terminal on line 31 will be compared in the comparator 63, as previously indicated, to determine whether the signal is an authorization code. At the same time, the signals on line 31 will be shifted into a shift register 83 by self-clocking connection 85 and will be compared in a comparator 85 with an access denial instruction stored in a buffer 87. It will be seen that, in response to insertion of a card, either an authorization or a denial is expected on the line 31, and thus one of the comparators 63 and 85 is expected to provide an output signal. The outputs of comparators 63 and 85 on lines 67 and 89, respectively, are combined in an OR gate 91 which is utilized to reset the flip-flop 79 (if the degraded mode has previously been entered) and is also used to reset the 10-second timer 75. Thus, once operation of the 10-second timer 75 is initiated, if an authorization or denial code which favorably compares with the data stored in the buffers 65 and 87 is received on line 31 within 10 seconds, the signal from the OR gate 91 on line 93 will reset the timer 75 so that it will not time out. In this circumstance, the timer 75 will not provide a set signal on line 77 for the flip-flop 79, and the degraded mode will not be entered.

Even when the system is in degraded mode, insertion of a card will again close the switch 17 and initiate operation of the 10-second timer, so that, if the problem with the communication lines has been corrected, a signal will be received on line 31 which will provide an input to the OR gate 91 to reset the timer 75 and the flip-flop 79, the latter resetting operation placing the system once again in its normal operational mode.

While the signal from switch 17 has been described as initiating the timing period of timer 75, those skilled in the art will recognize that other events could begin the timing sequence. Thus, for example, completion of the data teansmission from the transfer network 25 could be used for this purpose.

From the foregoing description, it can be seen that virtually the entire system is checked by this improved system, and the degraded mode will be entered upon failure to receive a proper authorization or denial code from the central processor in response to card insertion.

While the system described in reference to FIG. 1 is adequate for operating this degraded mode system, the preferred embodiment incorporates a programmed microprocessor. This preferred system is shown in FIG. 2 and includes an asynchronous receiver/transmitter 101 connected to the polling and data line 31 as well as the line 27, the output and input lines, respectively, for communicating with the central processor. The receiver/transmitter, in the preferred embodiment, is sold by Motorola Electronics under Part No. MC6850. The receiver/transmitter 101 is connected by a two-directional communication link to a microprocessor 103 sold by Motorola Electronics under Part No. MC6800. The processor 103 is interconnected in a well-known manner with a read only memory 105 sold by Signetics under Part No. 2616, a read and write memory 107, sold by Motorola Electronics under Part No. MCM6810AL and a programmable read only memory 109, sold by Intersil under Part No. IM5610. A program listing is stored in the read only memory 105 and is included at the end of this specification. The receiver/transmitter 101, microprocessor 103 and a peripheral interface adapter are interconnected in a known manner to a master clock 111 which provides timing signals for the entire system. In addition, the microprocessor 103 is connected to the peripheral interface adapter 113 sold by Motorola Electronics under Part No. MC6820. This interface adapter 113 is, in turn, connected to the coil detector 115, described and claimed in U.S. Pat. Nos. 3,686,479 and 3,717,749, to a card in detector switch 117 identical to the switch 17 of FIG. 1 and a driver and relay network 119 for operating an access apparatus 121, which are identical, respectively, with the units 69 and 71 described and referenced to FIG. 1.

The program which operates the system of FIG. 2 and which is stored in the read only memory 105 is as follows: ##SPC1## ##SPC2## ##SPC3## ##SPC4## ##SPC5## ##SPC6## ##SPC7## ##SPC8## ##SPC9## 45/916