Commonly, keys for gaining access to different parts of a building or a site are stored in a locked key cabinet which can be unlocked only by authorised personnel. Such a method of controlling access is inflexible insofar as any person having access to the cabinet may then have access to the whole building or site.

The present invention provides, according to one of its aspects, a key control system for controlling the use of a plurality of keys comprising a key control centre including communication means and means configured to store user data and data relating to key removal rights associated with each of a plurality of key users ; and a plurality of key control units located remotely from the key control centre, and including signalling means for exchanging electrical signals with the key control centre via the communication means and each comprising a base housing a plurality of key retention devices individually actuable by the signalling means in response to key control signals from the key control centre, the key retention devices having associated key detectors coupled to the signalling means for monitoring the presence or absence of the respective keys, wherein the signalling means are configured to signal the presence or absence of the keys by means of key monitoring signals indicative of the status of the detectors and sent to the key control centre.

The key control centre includes data processing means which may be configured to store key presence and absence indications according to the monitoring signals received from the key control unit and automatically to generate an alarm indication when any of a plurality of monitored keys is indicated as being absent for more than a predetermined key removal period. Different keys and different users may be assigned different maximum key removal periods.

Preferably, each key control unit includes a releasable cover extending over the said base to cover the key retention devices, and a user identifying device for generating a user identifying signal which the signalling means are configured to transmit to the key control centre. The key control centre may be configured to allow generation of an access authorisation signal in response to a comparison of the user data contained in the user identifying signal with the stored user data, the key control units being configured to release the respective cover on receipt of the access authorisation signal by the signalling means from the key control centre. The user identifying device can comprise a card reader, a reader for reading a wireless tag or fob, or a keypad accessible from outside the cover, the keypad being operated by the user to enter a user identification code.

Each key control unit may include a camera oriented to generate an image of the face of a user facing the key control unit, the camera being coupled to the signalling means inside the key control unit which operate to transmit the image as an image signal to the key control centre. The key control centre preferably includes means allowing comparison of the received image with a stored user image. This comparison may be carried out by means of an operator viewing the received and stored images side-by-side or the comparison may be performed automatically using image analysis software.

The camera may be located behind the above-mentioned cover, or two or more cameras may be provided, one behind the cover, and another mounted externally, adjacent the key control unit.

Opening of the cover may also provide access to a normally concealed user instruction display device which may be used to prompt user actions such as the selection of a particular key or keys to be removed or replaced.

According to another aspect of the invention, a key control unit for use in combination with a remotely located key control centre connected to the key control unit by means of a communication link comprises: signalling means having an input and an output for

connection to the communication link for exchanging electrical monitoring and control signals with the key control centre; and a base which houses a plurality of key retention devices individually actuable by the signalling means in response to key control signals received at the said input, the key retention devices having a plurality of key detectors coupled to the signalling means for monitoring the presence or absence of the respective keys; wherein the signalling means are configured to signal the presence or absence of the keys by means of key monitoring signals delivered to the said output and indicative of the status of the detectors.

According to a third aspect of the invention, there is provided a key control method using å key control system in which a key control unit housing a plurality of keys in key retention devices with associated key detectors has signalling means for signalling a remote key control centre over a communication link, the key control centre storing user data and data relating to key removal rights associated with each of a plurality of key users, wherein the method comprises transmitting user identification data from the key control unit to the key control centre over the communication link, comparing the user identifying data with the stored user data, and, conditional upon the comparison result, transmitting to the key control unit key control signals for controlling release of the keys from the key retention devices via the signalling means, the signalling means further monitoring the presence or absence of the keys in the respective key retention devices by generating key monitoring signals indicative of signals received from the key detectors, and transmitting the key monitoring signals to the key control centre.

According to a fourth aspect of the invention, there is provided a key control method using a key control system in which a key control unit housing a plurality of keys in key retention devices has signalling means for automatically communicating with a remote key control centre over a communication link, the key control centre storing user data and data relating to key removal rights associated with each of a plurality of key users, wherein the method comprises transmitting user identification data from the key control unit to the key control centre over the communication link, comparing the user identifying data with the stored user data, and, conditional upon the comparison result, transmitting to the key control unit key control signals indicative of keys which a user

identified by the user identification data is authorised to remove, the signalling means generating key release signals corresponding to the key control signals which are fed to the key retention devices corresponding to the indicated keys, the said keys then being released for use. The key release signals may be generated only in respect of keys identified by key selection signals generated in the key control unit in response to user requests, such key release signal being generated only if key control signals identifying the selected key as being authorised for use by the respective user have been received from the key control centre.

Typically, the sequence of operations begins with activation by a user of the user identifying device, comparison of the user identification data with stored user data, unlocking of the key control unit cover in response to a positive comparison result, selection of an individual key or keys by the user, actuation of the respective key retention device or devices in response to the selection signals, such actuation being conditional upon stored data relating to key removal rights associated with the respective user, the user then removing the requested key or keys. When the user returns to the key control unit, the key or keys may be returned in a similar manner, albeit without the key authorisation check. The system may record each key transaction, and may provide an alarm, as described above, if any key is absent from the key control unit for more than a predetermined time interval.

In the manner described above, each of a plurality of users is given access only to the keys that he or she needs, a positive user identification check can be performed, and details of each key transaction can be recorded as an aid to investigation of any security breaches.

The invention will now be described by way of example with reference to the drawings in which:- Figure 1 is a block diagram of a key control system in accordance with the invention ;

Figure 2 is a front perspective view of a key control unit forming part of the system of Figure 1; Figures 3A and 3B are respectively front and plan views of a key retention device, several of which are used in the key control unit of Figure 2; Figures 4A and 4B are respectively plan and end views of a row of key retention devices shown in juxta position with corresponding solenoids, as used in the key control unit of Figure 2; Figure 5 is a simplified cross section of the key control unit, on a horizontal plane; Figure 6 is a block diagram of the key control unit ; Figure 7 is a diagram of database links between databases stored in the key control centre ; and Figures 8A and 8B together constitute a flow chart indicating operations performed by the key control centre and the key control unit when processing a key transaction.

Referring to Figure 1, a key control system in accordance with the invention comprises a key control centre 10 and a plurality of key control units 12 located remotely from the key control centre, each connected or connectable to the key control centre 10 by communication links 14 which are typically telephone lines forming part of a public switched telecommunications network. Each key control unit 12 comprises a cabinet which is controllable under remotely from the key control centre 10, the cabinet containing a number of keys for gaining access to different parts of a site associated with the key control unit. The key control centre is a control and monitoring station having its own processing facilities for processing signals received from the key control units 12, and having storage means for storing data relating to designated users at each site together with data relating to key removal rights associated with each key user.

A key control unit 12 is shown in more detail in Figure 2. Referring to Figure 2, the key control unit 12 has a base 20 enclosed by a cabinet 22. The cabinet 22 has a door 22D which, in its closed position covers the base 20 and which, therefore, prevents access to a plurality of key retention devices 24 (in this case 40 key retention devices) and a user interface 26. Each key retention device 24 comprises a lock barrel and associated key release solenoids Associated with each key retention device 24 is a key release microswitch for detecting the presence or absence of a key in the respective key retention device 24. The user interface comprises a panel having a first liquid crystal message display 26A and control push buttons 26B. Accessible on the outer surface of the cabinet 22 is a user identifying device in the form of a key fob detector 28 for sensing a magnetically encoded key fob presented to the detector by a user wishing to gain access to the cabinet. A camera 30 situated adjacent the cabinet 22 monitors user activity in the region of the cabinet 22.

The key control unit will now be described in more detail with reference to Figures 3A and 3B, 4A and 4B, and Figure 5.

As mentioned above, each key retention device 24 comprises a lock barrel and an associated key release solenoid. Referring to Figures 3A and 3B, each lock barrel 24A is cylindrical in form and has a front aperture 24B for receiving a tubular key shaft which, when turned in the lock barrel 24A is retained within the barrel. Projecting from the rear face of the lock barrel 24A is an actuation pin 24C which is spaced from the central axis of the lock barrel 24A and which rotates with the inserted key shaft about the lock barrel axis. The cylindrical side wall of the barrel has a pair of mounting holes, one of which his shown (reference 24D) in Figure 3B.

The 40 key retention devices 24 shown in Figure 2 are arranged in rows and columns.

One such row is shown in Figure 4A. As will be seen from Figures 4A and 4B, the respective four lock barrels 24A are mounted between flanges 20A associated with the base plate 20 (Figure 2) of the key control unit 12. Mounted behind each lock barrel 24A in a parallel bracket 20B are four key release solenoids 25 mounted in a row and

each having an armature 25A here shown in registry with the actuating pin 24C of a respective lock barrel 24A.

The solenoids are constructed such that their respective armatures 25A are spring-biased towards an extended position, i. e. in the direction of the lock barrel 24A and such that, when each solenoid is energised, its respective armature 25A is retracted, i. e. away from the lock barrel 24A.

Each solenoid 25 is mounted such that its respective armature 25A is in registry with the actuating pin 24C of the corresponding lock barrel 24A when the pin 24C is in the position it adopts when a key can be inserted and withdrawn from the lock barrel 24A.

When a key is received in the lock barrel 24A and is rotated away from the key insertion position, the key is trapped in the barrel 24A and the pin rotates out of alignment with the respective solenoid armature 25A, and the armature 25A moves outwards, away from the body of the solenoid 25, thereby forming a stop which prevents the pin 24C moving back into a alignment with the armature 25A.

Accordingly, once the key has been inserted and turned, it cannot be withdrawn from the lock barrel 24A unless the solenoid is energised to retract the armature 25A so as to allow movement of the pin 24C into the aligned position. This means that the key is retained in its respective lock barrel and is prevented from being withdrawn without position energisation of the solenoid 25.

Associated with each actuating pin 24C is a low pressure microswitch 27 mounted, as shown in Figure 4A, on the bracket 20B, with a movement sensing wire extending across the rear face of the lock barrel 24A adjacent the locking pin 24C of the respective locking barrel 24A. (It should be noted that only one microswitch 27 is shown in Figure 4A. In practice, each lock barrel 24A has a corresponding microswitch 27. ) The microswtiches 27 sense the presence or absence of keys in the lock barrels 24A by virtue of the fact that they are operated when the respective actuating pins 24C move out of alignment with the solenoid armatures 24A.

A subsidiary function of the microswitches 27 is to control a circuit disabling energisation of the solenoids 25 when, in each case, the actuating pin 24C is sufficiently close to the armature 25A that it can abut the side of the armature 25A due to a turning force applied on a key received in the respective lock barrel 24A. This prevents the flow of electrical current in the solenoid winding when withdrawal of the armature 25A is prevented by the application of such a sideways-directed force.

It will be appreciated that the cabinet 22 (Figure 2) has ten such rows of lock barrels 24A and solenoids 25, together with associated microswitches 27. The mounting of these components in the cabinet 22 is shown in more detail in Figure 5. Referring to Figure 5, the front faces of the lock barrels 24A are exposed within a front cavity 22C of the cabinet 22 when the door 22D (Figure 2) is open. The outer casing 22E of the cabinet 22 is pivotable as a unit about a hinge axis 22H for serving purposes only, such access being controlled by a lock mechanism 22L.

Referring now to Figure 6, in n this key control unit embodiment, signalling means in the form of a camera controller 50 and a programmable logic controller (PLC) unit 52 operate in combination to sense the presence of a key fob at the key fob detector 28 to receive stored CCTV images from five cameras 30 and 54A to 54D, to initiate a connection with the key control centre via a communication link 56, to operate the key release solenoids 25 associated with the key retention devices 24 (see Figure 2), and a key control unit door lock release solenoid 60 controlling the lock for the cabinet door 22D (Figure 2), and for generating visual and audio messages using displays 26A, 64, and 66.

The key fob detector 28 is coupled to a decoder 70 which has a numerical display 70D which displays a key fob identity number and which is viewed by a user ID CCTV camera 54A mounted inside the cabinet and coupled to the camera controller 50.

Decoder 70 is coupled to the PLC unit 52 for the purpose of generating a message on an internal message display 64 which is, in turn, viewed by a CCTV camera 54B mounted internally in the cabinet, and coupled to the camera controller 50. The display 64 is used to display a number of different messages relating to activities of the user and the

status of the cabinet 22, which are monitored by CCTV camera 54B. The camera controller 50 encodes the images produced by camera 54B for transmission via a modem 72 and the communication link 56 to the key control centre. In addition to the externally mounted CCTV camera 30 (which provides a view of the key control unit and the user), a camera 54C mounted on the base 20 of the cabinet 22 provides an image of the user, in this case, a facial image, which, like all of the CCTV camera images, is fed to the camera controller, is stored and can be transmitted to the key control centre over the communication link 56.

The third message display 66 is viewed by camera 54D.

Associated with the key release solenoids 25 are the key release microswitches 27 which, like the solenoids, are coupled to the PLC unit 52. These microswitches 27 sense the presence or absence of keys in the key retention devices 24 in the manner described above. The status of each microswitch is signalled by the PLC unit 52 to the internal display 64, which is monitored by the camera 54B. Similarly, a key control unit door switch 76 allows monitoring of the cabinet door 22D (Figure 2) via the PLC unit 52, display 64, and camera 54B.

The PLC unit 52 also drives the user interface 26 mounted on the base 20 of the cabinet for displaying instructions and information to the user, and allowing the user to select the keys, for instance, using the push buttons 26B, as will be described below.

A digital audio board 78, coupled to the PLC unit 52 and having an output coupled to a loudspeaker 80 inside the cabinet 22 generates a series of standard audio messages for guiding the user, while variable audio instructions from the key control centre, relayed over the communication link 56 via the camera controller 50 can be emitted by a second speaker 82 inside the cabinet 22, user responses being picked up by a user microphone 84 inside the cabinet.

As an aid against tampering, the PLC unit 52 is also connected to a vibration sensor 86 on the cabinet 22. Tampering with the cabinet causes a signal to be sent to the camera

controller 50 which is arranged to activate the communication link 56 in order that the images from camera 30 can be viewed at the key control centre.

In this embodiment, the communication link 56 is activated only when one of the cameras 30 and 54A to 54D senses an image change, or when the vibration sensor detects tampering with the cabinet 22. It will be appreciated that operation of the key fob detector 28 causes a key identification number to appear on the display 70D of the decoder coupled to the key fob detector 28. Camera 54A picks up the change in the display and causes the communication link to be activated.

The camera controller 50 is a known digital video system (Recam system available from Euroteck Limited) that controls the communication link activation via the modem 72, and has its own bespoke software. The controller 50 has a digital video image recording facility which records the images received from each camera continuously whilst a key transaction is in progress, together with other moving images. The images are recorded on a roll-on roll-off basis and are downloadable upon external request via the communication link 56 from the key control centre. This allows visual tracing of each key transaction and other events affecting security.

The decoder unit 70 coupled to the key fob detector 28 interprets signals from the detector 28 and acts as an access control unit which stores up to 99 user codes, in this embodiment.

The primary functions of the PLC unit 52 are:- (a) Receiving signals from the access control unit 70, the door switch 76, the camera controller 50 and the key detectors 27 ; and (b) Producing control outputs to the digital audio messaging device 78,80, to the key release solenoids 25 (for releasing keys from the retention devices 24 (Figure 2) ), to the door lock 42, and to the camera controller 50 for commencing communication link activation.

The program within the PLC unit 22 evaluates the operational conditions within the whole system (key control centre and key control unit) and operates controls on the releasing and returning of keys. An uninterruptible power supply (UPS) (not shown) is provided to power the KCU in the event of mains power failure.

The key control centre 10 shown in Figure 1 has a PC-based system storing several databases, as shown in Figure 7. The contractor database 90 stores contractor details relating to each key control unit 12, including contact numbers. Database 90 is linked to an employee database 92 listing employees for each contractor with employee (user) ID numbers and photos, as well as passwords. A status-type reference 93 is used for indicating whether employees are current or non-current, to facilitate rapid or temporary changes in access rights.

Linked to the employee database 92 is a key use database 94 which is updatable with each key removal or replacement, and this contains a transaction identifier, the employee (user) ID, KCU ID and key ID, as well as removal and replacement times.

Keys database 96 list the keys by KCU, including their position in the KCU together with a predetermined maximum key removal time period which, if exceeded, causes generation of an alarm at the key control centre. Authorisation data 97 matching employee and key ID's is collected from the employee and key data, as shown, for generating key control signals identifying individual keys or types of keys for use by respective users. Linked to both the key use database and the keys database is a cabinet or KCU database 98 with cabinet identifications and contact numbers. A key type database 99 allows categorisation of keys so that users can be approved for a specified category or categories of keys, as well as particular numbered keys.

Referring now to Figures 8A and 8B, key transactions are controlled by the key control unit and the key control centre according to the following sequence. When a user presents an identifier, in this case a key fob carrying a code unique to the user, to the key fob detector 28 (see Figures 2 and 6) (step 100), the decoder circuit 70 displays the

user ID number and signals the PLC unit 52 which dials the communication link to the key control centre (step 102).

At the same time, the PLC unit 52 activates a first audio message via message circuit 78 and speaker 80 informing the user that a connection to the key control centre is being made (step 104). If no response is received from the key control centre within one minute, a further audio message is triggered telling the user that the control centre is busy and to repeat the request at a later time (steps 106,108).

Successful activation of the communication link by the modem 72 (Figure 6) (step 110) allows an operator at the control centre to view the user ID displayed on display 70D (Figure 6) and an image of the user produced by camera 54C (Figure 6) (step 112). At the same time, the operator can key in the user ID number at the key control centre to display an image of the user from database 92 (Figure 7), allowing comparison and approval or otherwise of the user identity (step 114).

If the user is not approved, the operator of the key control centre can speak to the user via communication link 56, camera controller 50 and speaker 82 (Figure 6) (step 116).

If a positive user approval command is given by the operator, the key control centre signals the key control unit via communication link 56 to cause the PLC unit 52 (Figure 3) to operate the door lock solenoid 42 to unlock the cabinet door 22D (Figure 1).

Simultaneously, the PLC unit 52 is triggered to generate a standard audio message via speaker 80 informing the user that the connection to the control centre has been made and asking the user to open the cabinet door (step 120).

When the user opens the door (step 122), display unit 26A (see Figure 6) instructs the user to operate the arrow shaped buttons on the user interface 26 to scroll up or down displayed key numbers to select a required key (step 124). Operation of the buttons 26B (step 126) causes selected key numbers to be displayed (step 128), whereupon confirmation by the user of the required key number and an indication of key removal or key replacement being required (steps 130 and 132) results in a decision step 134 at

the key control centre causing a display to the key control centre operator indicating key removal (step 136) or key return (step 138).

At this point, a check is performed at the control centre to check that the user is authorised to remove the selected key (step 140). If the check is positive, a signal is sent from the key control centre to the key control unit causing the PLC unit 52 to release the respective key retention device via associated solenoid 25 (Figure 6) and to display an instruction on the user interface display 26A for the user to take or return the key and to indicate whether a further key is to be removed or replaced (step 144). If the answer is that another key is to be dealt with, a corresponding message is displayed at the key control centre (step 144), and the sequence returns to the key selection step 124.

If the user did not wish to remove or replace a second key, a corresponding display is visible at the key control centre (step 146), a signal is passed to the PLC unit 52 to cause display of an instruction to the user to close the door 22D (Figure 2), whereupon the communication link is terminated at the key control centre end (step 150). Closing of the door by the user (step 152) causes a system reset at the key control unit end (154).

Should the authorisation 140 produce a negative result, the user is presented with a"not permitted"display on display 26A (step 156), and the sequence returns to the key selection instruction 124.

Summarising, particular security of this system arises from a manned control centre interacting with local PLC-controlled sequences during key transactions (both the control centre and the user taking a key are guided through each sequence by the PLC), together with the method of key retention, i. e. keys retained in locks from which they cannot be released unless authorised by the PLC.

Particular novel aspects of the system are set out below.

(a) The key control units each contain a PLC programmed to allow user access into the key control unit when a plurality of conditions are met and subsequently to allow

release or return of keys, when a plurality of conditions are met. The PLC, with bespoke software, controls the sequence of events during key transactions, i. e. it advises the person at the control centre of each step to take, it also advises the user taking the key of each step to take, guiding both through each step of transaction.

(b) The above-mentioned sequence of transactions performed by the user at the key control centre is viewed by live video. The key control unit contains a video storage device that stores locally all of the video sequences relating to each transaction. This information can be played back when the key control system is interrogated by the control centre, providing complete key tracetability information. All video sequences are'timed-stamped'. The cameras at the key control unit provide live viewing for the key control centre via a video link as, as mentioned, this video footage is stored in the key control unit. The cameras provide live viewing of any, preferably all, of the following: 1. User outside the key control unit presents the fob. (From this the PLC identifies the user.) 2. View of the fob ID number (as a digital display of the ID number).

3. Once key control unit door is opened, views face of person standing in front of cabinet.

4. View of the key status of the cabinet, i. e. the keys are numbered and when a particular key is not there its number will light up all controlled by the PLC.

5. View of another display the feedback display which displays instructions from the PLC guiding the control centre person through each step of a transaction.

(c) The keys are retained in locks of the kind they are designed to open. These locks are such that each key can only be withdrawn when it is at a predetermined position (rotational position) in the respective lock. Preferably each of the locks is different from the others and is unique in the sense that it can only retain a respective one of the plurality of keys.

The invention includes, as individual aspects, each of the features mentioned above, both independently of each other and in combination.