The present invention relates to recording locks; that is, to closure devices such as locks which include means for generating a code indication which can be separately recorded.

Locks, such as padlocks, are well known as means for preventing unauthor¬ ized access to containers. Their security is however limited, for two reasons. First, they are vulnerable to picking; and although lock designers are aware of this, their design freedom is constrained by the need to combine reasonable cheapness and robustness. Second, although a design reasonably proof against picking may be attainable, the mechanical design of the lock is often only one, relatively minor, feature in a security system. In a large-scale system for the distribution of goods, for example, there will be a very large number of contain¬ ers moving between a large number of locations. The keys will therefore be distributed widely, and many people will have possession of them. The security of the keys will therefore be low,

To overcome this problem, it has long been known to use some form of seal in addition to the lock itself. Once the seal has been made, its breaking is irreversible. Thus the presence , of an unbroken seal indicates that the protec¬ ted container has not been tampered with. Such seals are however themselves subject to manipulation. Since they are one-time devices, they are normally required to be much cheaper than locks, and with many of them, it is possible to reseal them sufficiently well for them to pass a cursory inspection.

Accordingly a further technique of improving the security of a system using locks has been 'devised. This technique accepts that the security of the- locks will be low, and therefore consists of providing means for rapid detection of unauthorized opening of the locks, comprising a recording lock. A recording lock includes some form of sealed mechanism, either mechanical or electrical/elec¬ tronic, which generates a code indication each time the lock is opened and closed. When the lock is operated, the code indication is recorded separately from the lock. When an authorized person comes to open the lock, the code indication in the lock is compared with the recorded code indication. A match shows that the

lock has not been tampered with; a failure to match shows that an unauthorized opening and reclosing of the lock has taken place.

The object of the present invention is to provide an improved form of recording lock.

According to the present invention there is provided a recording lock including a sealed electronic unit with a memory, setting circuitry for recording a different code in the memory each time the lock is operated, and display means for displaying the code, characterized by a free-running clock circuit and in that the setting circuitry records the time at which the lock is operated.

The lock, in its normal form, thus uses a time indication as the code indi¬ cation. This gives several advantages. It is easier to record a time on a despatch note or the like than to record an arbitrary code value, because some degree of time recording is already almost universal; the date Cthough not the time of day) is in practice invariably noted on all such documents. It may not even be necessary to record the time code ^• on the relevant document, because it may be known (if there is a regular schedule of deliveries,, for example) or it may be available from some other associated documents (e.g. a driver's time sheet). If the lock has been opened without authorization, not only will the fact of unauthorized opening be evident, but the time at which the unauthorized opening occurred, will also be immediately apparent. This will usually be of considerable help in any subsequent investigations into the precise circumstances of the unauthorized opening of the lock.

Preferably the memory can store a plurality of times. The effect of this is that in the event of more than one unauthorized opening of the lock, all such openings will normally be recorded. Preferably also the setting circuitry is arranged to permit a fresh time to be recorded only after a predetermined interval from the previous time recorded. This prevents the possibility of one unauthorized opening being concealed by a later one for which a plausible explanation can be devised. If the setting circuitry is arranged to permit a fresh time to be recorded only after a predetermined interval from the previous time recorded, the memory preferably also stores, for each stored time, a count indicative of the number of times that the lock has been operated at that time. The count preferably increments until it reaches the maximum value which can be stored and then remains at that value.

The operation which causes a time to be stored may be the opening of the lock, its closing, ^: or both. If the setting circuitry permits a fresh time to be recorded only after a predetermined interval from the previous time recorded, as just discussed, then it can conveniently be arranged to store, along with the time, an indication of whether the operation (or group of operations at that time) was an opening of the lock, a closing of the lock, or a sequence starting with the opening of the lock and ending with its closing. The display will of course display this information along with the time.

The electronic unit is preferably sealed at manufacture. Since it is com ^¬ parable with an electronic wrist watch but not subject to the same constraints regarding lightness, it can normally be provided with a battery which will give it a life of several years. It will of course be set to the correct time when the unit is sealed. For many purposes, conventional electronic clock circuitry will maintain sufficient accuracy over the intended life of the unit. But even if the unit's accuracy is poor and its indication drifts appreciably from the true time, the error will be substantially constant between the time of locking and the associated time of checking, and can thus readily be allowed for.

It is clearly desirable for the different possible displays to be clearly recognizable. The current time display can readily be made recognizable, by displaying the seconds value (which will be constantly changing) or by providing a pulsing divider between say the hours and minutes values (as is common with wrist watches). The different recorded times should also be made readily distinguishable. This can be done by providing a counter which counts how far back through the stored sequence the system has been stepped, and displaying its value. Alternatively, the span of the stored times may be made sufficient to avoid ambiguity; thus if the date (day of month and month of year) is included, it will always be easy to recognize the successive stored times.

Although the sealed unit will not have any means whereby the time setting of the clock can be changed, it will normally have other controls. Although it preferably stores several successive times of opening, it will normally have a display which will show only a single time. Thus a control for displaying the successive stored opening times will be required. In addition, it will normally be convenient for the current time to be displayed, and a control for changing between this and the display of stored times will also be required; this may be either separate from or combined with the control for stepping through the

stored times. It may be desirable for the control for displaying the stored times to be concealed or operable only by means of a key of some sort; this gives a further degree of security to the system.

The sealed unit may also contain circuitry which monitors the state of the battery and gives an indication if the battery is approaching failure. Such indication can be given, for example, by a modification of the normal time display, or by a battery state indicator.

In a modified form of the lock, the code indication consists of a serial number in combination with the time indication, with the serial number being incremented each time the lock is operated. (Obviously, each time stored has the associated serial number stored with it.) Preferably the serial number is normally displayed, with the associated time being displayed only in response to the operation of control means on the lock. One advantage of this form of the lock is that ^" if the container closed by the lock is supposed to follow a standard routine, then its security can be checked simply by checking whether the serial number has reached the expected value. Another advantage is that the use of times as the primary or sole code indication could be confusing in, e,g, airline operations where the container being protected may pass- to and fro through several time zones, so that the time indication on the padlock will often not match the actual local time. (Indeed, such mismatch will occur even in a single time zone if there is a change between normal and summer time.)

The lock may be a self-contained free unit such as a padlock, or it may be made as an integral part of a container.

A padlock embodying the invention will now be described, by way of example, with reference to the drawings, in which

Fig. 1 is a diagrammatic perspective view of the padlock, and

Fig. 2 is a block diagram of the circuitry contained in the padlock.

Referring to Fig. 1, the padlock 10 is of generally conventional shape, comprising a hasp 11 and a body 12, with a conventional mechanism (not visible) operated by means of a key (not shown) inserted in a keyhole (not visible) in the bottom end of the body 12, i.e. at the end opposite the hasp 11.

The padlock also includes circuitry permanently sealed within its structure. The only elements ¹ of this circuitry shown in Fig. 1 are a digital display device 18, a switch 21, and a switch 30. The switch 21 is within the body 12 of the padlock and is operated by the mechanical operation of the padlock, i.e. by the opening and/or closing of the hasp.

Fig. 2 is a simplified block diagram of the circuitry. A free-running oscillator 14 drives a counter 15; these two units together form a clock unit, which counts minutes and hours. The initial state of the clock unit is set

(synchronized with real time) when the padlock is assembled by the manufacturer, and cannot be changed thereafter. The contents of the clock unit are fed via a selector circuit 16 and a driver unit 17 to the display device 18, which is a conventional six-digit unit in which each digit is displayed by means of a seven- bar digit display stage. The hours and minutes are displayed by the last four stages of the display device 18.

The switch SW1 21 is coupled to a memory .20, which has eight storage loca¬ tions arranged as a push-through stack. ^' When the switch SW1 21 is operated, the contents of the locations in the memory 20 are all pushed down by one location, so that the top location becomes empty and the contents of the bottom location are lost. The counter 15 is also connected to the memory 20, and the operation of the switch SW1 21 also causes the current time stored in the coun¬ ter 15 to be stored into the TIME section of that top location. Thus success¬ ive operations of the switch SW1 21 (provided they are at sufficiently widely separated intervals, as discussed below) cause the corresponding times of opera¬ tion to be stored in the memory 20.

The switch SW2 30 feeds a counter 31 which is coupled to the memory 20 and to the selector circuit 16. Operation of the switch SW2 30 increments the counter 31 (which is a cyclic counter with nine states, one more than the number of locations in the memory 20). The first eight counts correspond to the eight locations of the memory 20, and incrementing the counter 31 reads out the contents of the corresponding location and selects the memory output by means of the selector 16. The stored time is thus passed through to the display device 18 and displayed. At the same time, the count in the counter 31 is passed via line 32 through the selector 16 and displayed in the second digit stage of the display device. The ninth count of the counter corresponds to the current time, and causes the contents of the counter 15 to be passed to the display device.

If desired, the counter 31 can be arranged so that if switch SW2 30 stays unoperated for a predetermined time, it automatically cycles round to the ninth count, so that the display always reverts to the current time in due course.

The switch SW1 21 is coupled to a- timer 22, which is also fed from the oscillator 14. The timer 22 normally produces a high output, enabling a gate 23 through which the output of the counter 15 of the clock unit is coupled to the memory 20. When the switch 21 is operated, the timer 22 is started, and runs for a predetermined time during which its output is low, before it reverts to the normal high state. The low output disables the gate 23, so that while it is low, no fresh time can be stored into the memory 20, Instead, the output of an inverter 24 fed from the timer 22 is fed to a usage count section UC of the top location of the memory 20. The initial clearing of the top location sets the usage count to 0. Each successive operation of the switch SW1 21 after the initial setting of a fresh time into the top location of the memory 20, while the timer 22 is. still running, causes the contents of the UC section of the top location to be incremented, up to a maximum of 7; counting is non-cyclic, so the count remains at 7 once 7 is reached. When the switch SW2 30 is operated and a stored time is displayed, the usage count UC associated with the stored time is also fed to the display device 18 and displayed by the first digit display stage.

The entire circuitry is operated from a battery 33.

It is thus evident that the system operates to store the times of operation of the last eight times that the padlock has been operated. These times may be inspected, one after the other, by operating the switch SW2 30. Each displayed time is identified by the display of the corresponding count from the counter 31. Further, it is not possible for an unauthorized person to erase the previously stored times by repeated operation of the padlock, because if the padlock is operated withi ' less than the time delay determined by the period of timer 22, the stored times remain unchanged. (The timer 22 is preferably resettable, so that it starts its timing period again if the switch SW1 20 is operated before it has finished a timing period.) Such repeated operation within the period of the timer 22 is recorded and indicated by the change of the usage count associated with the corresponding recorded time.

It will be evident that the system can be expanded in various ways. For example, a time locking mechanism can be provided, using the timer unit (units 14

and 15). This will of course require means to be provided for setting a time before which the lock cannot be opened. The setting mechanism may for example comprise a keypad, which means that the lock will, as a practical matter, have to be sufficiently large to carry the keypad. Alternatively, a setting mechanism similar to that used with wrist watches can be used.

Also, the system can additionally be provided with means for generating a random or pseudo-random code, which can be separately recorded, as with known recording locks.

A further possible modification is to generate and store, with each time, a serial number which is normally displayed instead of the time value, as discussed above.