Function module for an electronic access control

The disclosure relates to a function module for an electronic access control to a housing in electrical equipment. Electronic built-in modules are arranged in the housing. At least one of the built-in modules is connected to a data bus, wherein the built-in module is accessible via an interface and the data bus for the exchange of data. A switchable blocking module is provided according to the invention between the interface and the data bus, wherein the blocking module in a disable state restricts or interrupts the data traffic on the data bus at least for a data exchange between the interface and the built-in module, and in an enable state enables the data bus for an unrestricted exchange of data between the interface and the built-in module.

CROSS REFERENCE TO RELATED APPLICATION

This application claims priority of German patent application no. 10 2018 001 702.9, filed Mar. 3, 2018, the entire content of which is incorporated herein by reference.

FIELD OF THE INVENTION

The invention relates to a function module for an electronic access control to a housing for electrical equipment, wherein electronic built-in modules such as control modules, monitoring modules, switching modules or the like are arranged in the housing. The built-in modules are connected to a common data bus, wherein a built-in module is connected to an interface over the data bus. The built-in module is accessible through the interface for the exchange of data.

BACKGROUND OF THE INVENTION

A large number of built-in modules that are to be serviced electronically by corresponding data processing programs are installed in known housings, in particular in the case of switch cabinets in electrical installations and the like. Data access to the individual built-in modules is possible via an interface in order, for example, to update an individual built-in module and/or to call up, change or delete data. Firmware updates are, moreover, in most cases necessary for built-in modules with microprocessors in order, for example, to fix bugs, security loopholes or the like.

For data access, for example, to a switch cabinet, it must be opened, for which purpose the operating person must carry a mechanical key. It is disadvantageous that the operating person must—when servicing a plurality of switch cabinets—often keep various mechanical keys ready. In addition, an opening of the switch cabinet is usually not recorded, and there is therefore a possibility of manipulations.

SUMMARY OF THE INVENTION

It is an object of the invention to provide an access control system with various security levels for industrial use, with which a secure authentication and recording of a service person accessing the switch cabinet is possible.

The object is achieved with a function module wherein a blocking module is provided between the interface and the data bus which, when the blocking module is in a disable state, restricts or interrupts the traffic on the data bus and, when the blocking module is in an enable state, enables the data bus for a preferably unrestricted data exchange between the interface and the built-in module.

For an access to the housing and/or for a data access to the built-in modules in the housing, the service person must thus switch the blocking module into the enable state. This is done via a control unit that actuates the blocking module which is configured as a switch, in particular as an electronic switch. The blocking module is connected for this purpose via a control line to the control unit. The control unit is advantageously configured such that it only actuates the switching module after checking an authentication such as, for example, an access code, and its verification. The service person can thus only access the switch cabinet after authentication and/or after verification of an access code. The function module is advantageously configured as a common structural unit together with the control unit and the blocking module.

The control unit in particular includes a microprocessor that controls the communication to and from the control unit and verifies the authentications that are communicated. Such microprocessors store respective work records on the basis of which it is possible to establish which service person, at what time, to what extent and over what period of time had access to the housing or its built-in modules.

It is provided in a preferred form of embodiment that the control unit provides the authentication such as, for example, an access code, over a network. For this purpose the control unit is connected to the network, which can take place wirelessly or—preferably through the interface—via cable. After input of the necessary access data at an in particular mobile PC, the control unit expediently communicates with the web server for authentication. After verification of the received authentication, the control unit enables the blocking module. An in particular unrestricted communication between the interface and the built-in modules is enabled.

In an embodiment, the control unit is connected with at least one reading device for an authentication such as an access code. This reading device can be a card reading device, an RFID reading device, an NFC reading device or a similar reading device. The function of a reading device can be a component of the described invention.

It can also be advantageous for the control unit to be connected to a keyswitch. The keyswitch serves for the authentication, wherein, after actuation of the keyswitch, the control unit switches the blocking module into the enable state.

In a further embodiment, it is provided that the control unit is connected via a control line to an electromechanical locking apparatus for a door of the housing. A mechanical access control for the manual access to the built-in modules in the housing can in this way also be provided through the function module, so that a mechanical access is only opened to particular, qualified service persons.

It can be provided that the interface is provided inside the housing and/or outside the housing. An external interface can be provided in a wall of the housing, preferably in a side wall of the housing. This is made possible in a simple manner through the installation of appropriate built-in sockets, accessible from outside, such as SUB-D, RJ45, USB or similar sockets.

In a further embodiment, it is expediently provided that the enable state and/or the disable state of the blocking module is indicated by an in particular visual display.

DESCRIPTION OF THE PREFERRED EMBODIMENTS OF THE INVENTION

A housing1, which in the embodiment shown is a switch cabinet2, is shown schematically inFIG. 1. Switch cabinets2of this sort are used in electrical engineering for the installation of electrical equipment and the like in order to arrange built-in electronic modules6with different structures therein, and to wire them electrically. The built-in modules6can consist of one or a plurality of control modules8, monitoring modules9, switching modules12and the like, or similar modules. The built-in modules6are configured for an access to data.

The switch cabinet according toFIG. 1includes an access opening4(FIG. 2) closed by a door3. The door3is provided with a locking apparatus5in order to lock the switch cabinet2mechanically after the door3has been closed. In the embodiment shown, the locking apparatus5is configured as an electromechanical locking apparatus. The electromechanical locking apparatus5is operated by a control line11, which connects the locking apparatus5to a function module10for an access control, in particular with a control unit22(FIG. 2).

The opened housing1with the access opening4is shown schematically inFIG. 2. Support rails7are fastened to the rear wall of the housing1. The support rails7serve, in a manner known per se, to hold built-in modules6such as, for example, control modules8, monitoring modules9, switching modules12and the like. The built-in modules6, which in the embodiment are the control module8, the monitoring modules9and the switching modules12, are connected together via an, in particular common, data bus13. The data bus13connects an interface14to the built-in modules6, and enables a communication of each individual built-in module with the interface14.

The interface14can be arranged as an internal interface14awithin the housing1. The internal interface14ais only accessible after opening the housing1. Expediently, it can be an external interface14bwhich—as suggested inFIGS. 1 and 2—can be provided in a side wall15of the housing1, for example. The external interface14bis accessible from the outside when the housing1is closed.

The interfaces14can be configured as USB interfaces, as RJ45 interfaces, as sub-D interfaces, or the like. In the embodiment shown, USB interfaces16aand16bare provided both for the internal interface14aas well as for the external interface14b. The USB interfaces16a,16bare implemented as a USB socket16, known per se.

The internal interface14aand/or the external interface14bcan further include RJ45 interfaces17aand17b. Advantageously the RJ45 interfaces17aand17bare implemented as RJ45 sockets17.

Fundamentally, a single USB socket16or a single RJ45 socket17is sufficient as an internal interface14aand/or external interface14b. In the embodiment shown, the internal interface14ahas four RJ45 interfaces17aand three USB interfaces16a. The external interface includes two USB interfaces16band three RJ45 interfaces17b.

In the embodiment shown, both an internal interface14aand also an external interface14bare provided. It can be sufficient to provide only one internal interface14aor external interface14b.

The built-in modules6of the housing1are connected via the data bus13to the interface14. A blocking module20is provided between the interface14and the data bus13. The blocking module20is implemented as a switch18in the embodiment shown, in particularly as an electronic switch.

In the embodiments shown according toFIGS. 2 and 3, the blocking modules20,20aand20bare shown in the disable state. In the disable state, the switch18,18a,18bis open, so that data exchange between the interface14and one or a plurality of the built-in modules6is interrupted. In the disable state of the blocking module20, no data exchange is possible via the interface14with the built-in modules6. The blocking module is in the disable state when not powered, so that data access to the built-in module6is blocked in the event of a power failure.

The blocking module20is controlled via a control line21from a control unit22in order to change the switch state. The control unit22is advantageously configured to check an authentication such as, for example, an access code.

The authentication, made by way of example in the form of an access code, can be provided to the control unit22via a network connection, in particular a LAN connection. A LAN connection can be established in an easy manner via an external or internal RJ45 socket17.

It is preferably provided that a data access to the control unit22is enabled via the internal interface14aand/or the external interface14bindependently of the switch state of the blocking module20. In this way it is possible—both in the disable state of the blocking module20as well as in the enable state of the blocking module20—for the control unit22to communicate with a web server via a wired or wireless network connection. If the web server—after the input of access data by a service person—communicates a valid authentication to the control unit22, this will close the switch18and transfer the blocking module20into the enable state. The enable state of the blocking module20is suggested inFIG. 2by the dashed line.

Thus if the control unit22receives a valid authentication, for example an access code, the blocking module20is actuated via the control line21; the switch18changes from the disable state into the enable state, which is suggested by the dashed line. In the enable state, the data bus13is connected to the interface14, so that data exchange is possible between the interface14and one or a plurality of the built-in modules6. A service device, for example, a laptop or the like, connected via the interface14can call up, change or delete the data of the built-in module6, and/or update the microprocessor installed in a built-in-module with firmware and/or call up stored log data.

In addition to transmitting an authentication via a network connection to the control unit22, the authentication can, also or alternatively, be transmitted via a reading device23of the control unit22. The control unit22is connected for this purpose with at least one reading device23. The reading device can be a card reading device24and/or an RFID reading device25. Other types of reading device, for example, an NFC (Near Field Communication) reading device are also expedient.

In a simple form of embodiment, the control unit22can be connected to a keyswitch26which—through closing one or a plurality of contacts—outputs a corresponding authentication to the control unit22.

It can be expedient to indicate the switch state of the blocking module20, for which purpose a display27can be provided. In the embodiment shown, a visible display from a state indicator for the switch state of the switch18is provided. A first LED28can thus signal the disable state and a second LED29the enable state of the blocking module20.

The internal interface14aand/or the external interface14b, the blocking module20, the control unit22with the reading device23and/or the keyswitch26, as well as the display27, are preferably arranged in a common function module10which is to be built into the housing1or the switch cabinet2. Since all the elements necessary for the function are arranged in the function module10in a common construction unit, the function module10can be built into a housing, switch cabinet or the like without a high wiring effort. The function module10is, in particular, suitable for retrofitting to existing switch cabinets2.

The control unit22can, further, unlock the electromechanical locking apparatus5of the door3of the switch cabinet2via the control line11. To open the switch cabinet2, a service person connects a service device (mobile PC or the like) via an external interface14b, and communicates with the control unit22which is accessible via a data connection, independently of the switch state of the blocking module20. After transmitting a valid authentication, the control unit22unlocks the locking apparatus5, so that the switch cabinet2opens and all the built-in modules6are mechanically freely accessible for a service.

In order to be able to actuate the blocking module20without opening the switch cabinet2, a reading device23′, which can be configured, for example, as an RFID reading device, NFC reading device or similar contactless reading device, can be arranged, for example in the side wall15of the housing. A service person establishes a connection to the external interface14bvia a service device, for example, a PC, and identifies themselves to the reading device23′ via a corresponding chip or similar identifying element. The control unit22—after verifying a valid authentication—will transfer the blocking module20into the enable state; the service person can carry out necessary service work without opening the switch cabinet2.

In the embodiment according toFIG. 2, the data bus13is itself connected to the interface14via the blocking module20. In the embodiment according toFIG. 3, the data bus13leads to one or a plurality of fixed interfaces114, as shown inFIG. 3. These interfaces can, for example, be an RJ45 interface117aor a USB interface116a.

In the embodiment according toFIG. 2, a mains connection30for the supply of voltage to a service device, for example, a mobile PC, is furthermore provided. The mains connection30—expediently together with a safety device—is in particular integrated into the function module10.

The function module10according toFIG. 3is configured in such a way that the RJ45 interface117acan be connected via a first blocking module20ato the internal interface17a, while the USB interface116ais connected via a blocking module20bto the internal USB interface16a. According toFIG. 2, the interface14provided is either an internal interface14aand/or an external interface14b. Both the internal RJ45 interface17aand also the external RJ45 interface17bare connected via a data line directly to the control unit22, so that—independent of the switch state of the blocking module20a—a direct data access to the control unit22is provided both via the internal RJ45 interface17aas well as via the external RJ45 interface17b.

Accordingly the internal USB interface16aand/or the external USB interface16bare connected—in particular via separate data lines—to the control unit22, independently of the switch state of the blocking module20b.

The rest of the structure of the function module10corresponds to that ofFIG. 2, for which reason the same reference signs are used for the same parts.

In the embodiment according toFIG. 3, the internal RJ45 interface17aand/or the external RJ45 interface17bcan be activated separately from an activation of the USB interfaces16a,16b. An activation of the internal USB interface16aand of the external USB interface16bis accordingly possible, independently of the RJ45 interfaces17aand17b.

The function module10according toFIG. 3is in particular advantageous as a retrofitting set for existing switch cabinets. It can also be expedient to permit a restricted data access to the control unit through the interface. Independently of the disable state or the enable state of the blocking module, at least the electromechanical locking of the door of the housing can be operated.