Patent Description:
Trapped key interlocks define the sequence which needs to be followed in a mechanical manner- trapped key interlocks are operated by one or more keys, which are trapped and released in a predetermined order to create the sequence. Prior art document <CIT> discloses a smart interlock system and working method, while prior art document <CIT> teaches an electronic locking system for an automotive vehicle, and document <CIT> shows a lock apparatus and lock system.

The sequences required to operate trapped key interlocks, which may include a number of separate keys and locks, may be confusing to some users. This can result in safety issues arising if the incorrect sequences are attempted by a user, and can result in a user becoming frustrated with the interlock and attempting to bypass it.

Both the keys and locks of common trapped key interlocks are bespoke when manufactured, such that the key and lock are correctly mutually coded in a substantially unique manner (i.e. so that they fit one another and would not operate correctly with another key or lock). Bespoke manufacture may be costly and any changes to a bespoke lock and key may be difficult to implement. Lost or damaged keys are difficult to replace and, in some situations, would require replacement of the lock to avoid the missing key posing a safety issue if found.

Embodiments of the present invention seek to alleviate one or more problems associated with the prior art.

Aspects of the invention are set out in the appended claims <NUM> to <NUM>.

Embodiments of the invention are described, by way of example only, with reference to the accompanying drawings, in which:.

With reference to <FIG>, embodiments of the present invention include an interlock system <NUM> which includes a first key <NUM> and a first lock <NUM>. The first key <NUM> and first lock <NUM> are configured such that the first key <NUM> is engageable with the first lock <NUM> to actuate the first lock <NUM> between a first and a second condition.

The first key <NUM> and first lock <NUM> may be mechanically engageable such that a portion of the first key <NUM> is receivable by a portion of the first lock <NUM> to actuate the first lock <NUM> between the first and second conditions. Accordingly, the first key <NUM> may include a first key head <NUM> and a first key shaft <NUM>. The first key shaft <NUM> (or a part thereof) may be the portion of the first key <NUM> which is receivable by a portion of the first lock <NUM>, for example, and may be keyed to be so received. As such, the first lock <NUM> may define a first key receiving aperture <NUM> which is the portion of the first lock <NUM> which is the configured to receive the portion of the first key <NUM> (e.g. the first key shaft <NUM> (or part thereof)). The first key receiving aperture <NUM> (and more generally, the first lock <NUM>) may be keyed to receive the first key <NUM>.

According to the invention, actuation of the first lock <NUM> between the first and second conditions includes movement of the first key <NUM> with respect to the first lock <NUM> when the first key <NUM> and first lock <NUM> are engaged. This may include, for example, receipt by the first lock <NUM> of the portion of the first key <NUM>, rotation or linear movement of the first key <NUM> with respect to part of the first lock <NUM> to drive movement (e.g. linear or rotational) of a part of the first lock <NUM> to actuate the first lock <NUM> between the first and second conditions. The first key <NUM> may be removable from the first lock <NUM> with the first lock <NUM> in the first and second conditions and these may be different rotational positions of a part of the first lock <NUM> with respect to another part thereof. Accordingly, the first key <NUM> may be inserted into the first lock <NUM> with the first lock <NUM> in the first condition and removed from the first lock <NUM> with the first lock <NUM> in the second condition (and vice versa).

In some embodiments in which there are a plurality of keys of similar form to the first key <NUM> and a plurality of locks corresponding with the first lock <NUM>, there is a need to provide a mechanism by which the correct keys are configured to actuate the correct locks.

This may be achieved mechanically in some embodiments by providing the first lock <NUM> to receive a key of the shape and configuration of the first key <NUM> and not to receive a key of a different shape or configuration.

In some embodiments of the present invention the correct key is identified at least partly through the use of one or more virtual keys. A virtual key is a code which may be transferred between the first key <NUM> and first lock <NUM>, and may be a digital code which may be stored electronically (e.g. represented by a plurality of bits of information).

Accordingly, with reference to <FIG>, the first key <NUM> includes a first key memory <NUM> which is a data storage memory configured to store a virtual key. Similarly, the first lock <NUM> includes a first lock memory <NUM> which is a data storage memory configured to store a virtual key.

The first key <NUM> and first lock <NUM> may be configured to exchange at least one virtual key therebetween, with the or each virtual key being stored in the first key memory <NUM> and/or first lock memory <NUM> as the case may be.

In some embodiments, this exchange of at least one virtual key includes the transfer of a virtual key which may be a move operation or a copy operation. A move operation and a copy operation differ in that a move operation causes movement of the virtual key such that the virtual key is only stored in one of the first key memory <NUM> and first lock memory <NUM> but not both, once the move operation is complete. According to the invention, however, in a copy operation, the virtual key is stored in both the first key memory <NUM> and first lock memory <NUM>, once the copy operation is complete. The exchange of at least one virtual key may be a transfer of a first virtual key from the first key <NUM> to the first lock <NUM>, the transfer of a first virtual key from the first lock <NUM> to the first key <NUM>, or the transfer of a first virtual key from the first key <NUM> to the first lock <NUM>, and the transfer of a second virtual key from the first lock <NUM> to the first key <NUM>, or vice versa.

The first key <NUM> and the first lock <NUM>, therefore, include respective communication interfaces - a first key communication interface <NUM> and a first lock communication interface <NUM>. The communication interfaces <NUM>,<NUM> of the first key <NUM> and first lock <NUM> are configured to communicate with each other including the exchange of the virtual key, for example as described herein.

The first key communication interface <NUM> and the first lock communication interfaces <NUM>,<NUM> may use radio frequency communication signals to communicate. In some embodiments, the first key or lock communication interface <NUM>,<NUM> may be a passive interface such that the communication interface <NUM>,<NUM> generates electrical power for its operation through receipt of an electromagnetic (e.g. radio frequency) signal which may be generated and transmitted by the other of the communication interfaces <NUM>,<NUM>. In some embodiments, the first key and/or lock communication interface <NUM>,<NUM> may be part of a radio frequency ID tag (and so the other of the communication interfaces <NUM>,<NUM> may be part of a radio frequency ID tag reader).

The first key <NUM> includes a first key whitelist <NUM> which is configured to store details regarding one or more virtual keys which the first key <NUM> is authorised to receive and/or store in the first key memory <NUM>. Similarly, the first lock <NUM> further includes a first lock whitelist <NUM> which is configured to store the details regarding one or more virtual keys which the first lock <NUM> is authorised to receive and/or store in the first lock memory <NUM> and which may be required in order to actuate the first lock <NUM> between the first and second conditions. The first key whitelist <NUM> and first lock whitelist <NUM> may be provided on data storage memory which may be the same data storage memory which is also used for the first key memory <NUM> or the first lock memory <NUM> as the case may be.

The first key <NUM> may include a first key identifier <NUM> which may be stored on data storage memory which may also be used for the first key memory <NUM> and/or first key whitelist <NUM>, for example. The first key identifier <NUM> includes a substantially unique identifier for the first key <NUM>. In some embodiments the first key identifier <NUM> includes one or more type or usage codes - which may be codes which represent the type of first key <NUM>, the manufacturer of the first key <NUM>, the authorised user of the first key <NUM>, the functionality of the first key <NUM>, the intended use of the first key <NUM>, and the like.

Similarly, the first lock <NUM> may include a first lock identifier <NUM> which may be stored on data storage memory which may also be used for the first lock memory <NUM> and/or first lock whitelist <NUM>, for example. The first lock identifier <NUM> includes a substantially unique identifier for the first lock <NUM>. In some embodiments the first lock identifier <NUM> includes one or more type or usage codes - which may be codes which represent the type of first lock <NUM>, the manufacturer of the first lock <NUM>, the authorised user of the first lock <NUM>, the functionality of the first lock <NUM>, the intended use of the first lock <NUM>, and the like.

The first key <NUM> may include a first key lock identifier memory <NUM> which is configured to store the first lock identifier <NUM> and/or one or more other lock identifiers. The or each lock identifier may be stored in the first key lock identifier memory <NUM> when the first key <NUM> is currently actuating the lock to which the lock identifier relates and/or the lock identifier for each lock with which the first key <NUM> has exchanged one or more virtual keys may be stored - e.g. with each released virtual key being associated with a lock identifier in the first key lock identifier memory <NUM>. The lock identifier may be removed from the first key lock identifier memory <NUM> when the first key <NUM> has completed actuation of the associated lock and/or when the virtual key released to the lock has been returned to the first key <NUM>. Accordingly, the first key lock identifier memory <NUM> may record the identity of the locks with which it is currently or has previously interacted. The first key lock identifier memory <NUM> may be configured to store the current condition of the first lock <NUM> and any other locks with which it has interacted.

The first lock <NUM> may, therefore, include a condition detection arrangement <NUM> to determine its current condition - e.g. whether it is in the first or second condition. An indication of the current condition may be stored in the condition detection arrangement <NUM> (e.g. using a data storage memory which may also be used to store other data as described herein). This condition may be transmitted to the first key <NUM> (e.g. using the first key and first lock communication interfaces <NUM>,<NUM>). In this and some other embodiments, the first key <NUM> may store the condition of the first lock in the first key lock identifier memory <NUM>.

In some embodiments, the first key <NUM> is configured to determine whether the first lock <NUM> is in the first or second conditions - i.e. the condition detection arrangement <NUM> may form part of the first key <NUM> instead of the first lock <NUM> (and could form part of both in some embodiments). This may be done, for example by configuring the first key <NUM> and first lock <NUM> such that the first key <NUM> can determine its relative position (e.g. orientation) with respect to the first lock <NUM> on engagement of the first key <NUM> and first lock <NUM>. This may, in turn, be achieved by the use of a plurality of identifiable indicators on the first lock <NUM> wherein a first such identifiable indicator can be detected with the first key <NUM> engaged and in a first relative position with respect to the first lock <NUM> (the position being indicative of the first condition) and wherein a second such identifiable indicator can be detected with the first key <NUM> engaged and in a second relative position with respect to the first lock <NUM> (the position being indicative of the second condition). The first key <NUM> may have an arrangement to detect the or each identifiable indicator. Accordingly, when the first identifiable indicator is detected, it is determined that the first lock <NUM> is in the first condition and when the second identifiable indicator is detected, it is determined that the first lock <NUM> is in the second condition.

The or each identifiable indicator may be a respective radio frequency ID tag, magnet, conductive track, protrusion, and/or a tag of a different material. Accordingly, the arrangement to detect the or each identifiable indicator may be a radio frequency ID tag reader, a Hall Effect sensor, part of a circuit (which may be completed by the conductive track), a mechanical switch (which may be actuated by the protrusion, e.g. a micro-switch), and/or an inductance or capacitance sensor (wherein the tag of different material alters the inductance or capacitance measured in the sensor).

The first lock <NUM> may include a first lock key identifier memory <NUM> which is configured to store the first key identifier <NUM> and/or one or more other key identifiers for keys with which it is currently or has previously interacted (which may, again, be stored in associated with virtual keys received from the associated key).

The first key <NUM> may include a lock update memory <NUM> which is configured to store one or more updates for transmission to the first lock <NUM>. The one or more updates may include one or more software or firmware updates for one or more components of the first lock <NUM> and/or an updated first lock whitelist <NUM>. The or each update may be transmitted to the first lock <NUM> using the communication interfaces <NUM>,<NUM> of the first lock <NUM> and first key <NUM>.

The first key <NUM> may further include a first key controller <NUM> which is communicatively coupled with one or more of the other components of the first key <NUM> - e.g. one or more of the first key memory <NUM>, the first key communication interface <NUM>, first key identifier <NUM>, first key lock identifier memory <NUM>, lock update memory <NUM>, and the first key whitelist <NUM> - to control the operation and usage thereof.

Similarly, the first lock <NUM> may further include a first lock controller <NUM> which is communicatively coupled with one or more of the other components of the first lock <NUM> - e.g. one or more of the first lock memory <NUM>, the first lock communication interface <NUM>, first lock identifier <NUM>, condition detection arrangement <NUM>, and the lock key whitelist <NUM> - to control the operation and usage thereof.

Operation of some embodiments is depicted in figures 2a-2c. In particular, each of <FIG> show the first key memory <NUM> and first key communication interface <NUM> along with the first lock memory <NUM> and first lock communication interface <NUM>.

In a first state - as shown in <FIG> - a first virtual key K1 is stored in the first key memory <NUM> and not stored in the first lock memory <NUM> (which is depicted as empty but may store a different virtual key). The first key <NUM> may be brought into communicative range of the first lock <NUM> - such that the communication interfaces <NUM>,<NUM> can communicate with each other. This may involve receipt of the portion of the first key <NUM> by the portion of the first lock <NUM> - see above. In this communicative position, the first lock <NUM> may communicate with the first key <NUM> to provide the first key <NUM> with an indication of the one or more virtual keys which are required in order to actuate the first lock <NUM> between the first and second conditions. This indication may be in the form of a part of the first lock whitelist <NUM>, for example. In some embodiments, the first key <NUM> may determine if it has the required one or more virtual keys <NUM> and, if so, may transfer one or more such virtual keys <NUM> to the first lock <NUM>.

In a second state - as shown in <FIG> - the first virtual key K1 has been exchanged between the first key <NUM> and the first lock <NUM>. In particular, the first virtual key K1 has been transferred (by a move operation in this instance although a copy operation would also have been possible in some embodiments) using the first key communication interface <NUM> and the first lock communication interface <NUM> to the first lock memory <NUM>.

The exchange of the first virtual key K1 between the first key <NUM> and first lock <NUM> may be associated with actuation of the first lock <NUM> between the first condition and the second condition. Whether the first lock <NUM> is in the first or second condition may be determined in some embodiments by the condition detection arrangement <NUM>. In some embodiments, the presence of a virtual key stored in the first lock memory <NUM> (or a particular virtual key) may allow actuation of the first lock <NUM> between the first and second conditions. The actual actuation of the first lock <NUM> may involve movement of the first key <NUM> (engaged with the first lock <NUM>) with respect to the first lock <NUM> - as described above.

Accordingly, the first lock <NUM> may be configured to hinder or substantially prevent actuation from the first condition to the second condition unless the first virtual key is stored in the first lock memory <NUM> and/or in some embodiments unless the first virtual key is determined as present on the first key <NUM>. The first lock <NUM> may be configured to allow mechanical engagement of the first key <NUM> and first lock <NUM> to actuate the first lock <NUM> between the first and second condition (in some embodiments from the first to the second condition) when the first virtual key is stored in the first lock memory <NUM> and/or in some embodiments when the first virtual key is determined as present on the first virtual key <NUM>.

In a third state - as shown in <FIG> - the first virtual key K1 has been exchanged between the first key <NUM> and the first lock <NUM>. In particular, the first virtual key K1 has been transferred (by a move operation in this instance although a copy operation would also have been possible in some embodiments) using the first lock communication interface <NUM> and the first key communication interface <NUM> to the first key memory <NUM>.

As will be appreciated, the third state is the same - in terms of the resulting storage of the first virtual key - as the first state; however, in the third state, the first virtual key may have been transferred to a different key (e.g. a second key) which is otherwise comparable to the first key <NUM> (i.e. with the same features and functionality).

The exchange of the first virtual key from the first lock <NUM> to the first key <NUM> (or some other key) may be triggered, for example, by actuation of the first lock <NUM> between the first and second condition (e.g. from the second condition back to the first condition). This may be achieved, as described above, by mechanical engagement of the first key <NUM> (or other key) and the first lock <NUM> - and movement of the first key <NUM> with respect to the first lock <NUM>.

In some embodiments, the first lock <NUM> is prohibited from actuation between the first and second conditions when the first virtual key is not stored in the first lock memory <NUM> and/or in some embodiments not determined to be present on the first key <NUM>. When the first key memory <NUM> does not store the first virtual key, then that virtual key is not available to be exchanged with a different lock (otherwise having the same features and functionality as the first lock <NUM>). Therefore, the first key <NUM> cannot be used to actuate another lock requiring the first virtual key. The first virtual key is effectively trapped in the first lock <NUM> whilst in the second state described above. This trapping may occur even through the first key <NUM> and first lock <NUM> are disengageable, in some embodiments, with the first lock <NUM> in either of the first or second conditions.

In some embodiments, the first key memory <NUM> may be configured to store a plurality of virtual keys which may each be configured to operate different locks.

The operation of such an embodiment is described, as an example, with reference to <FIG> and <FIG>.

As shown in <FIG>, the first key <NUM> includes the first key memory <NUM> storing the first virtual key K1 and a second virtual key K2. The first lock <NUM> is shown with the first lock memory <NUM> not storing either of the first or second virtual key K1,K2. This is the equivalent of the first state mentioned above.

In <FIG>, the first virtual key K1 has been transferred from the first key memory <NUM> to the first lock memory <NUM> (via the communication interfaces <NUM>,<NUM> as described herein). The first lock <NUM> may then be actuatable between its first and second conditions - as discussed herein. This is equivalent to the second state mentioned above.

In <FIG>, the first key <NUM> is used to operate a second lock 3b - the second lock 3b has the same features and functionality as the first lock <NUM> as described herein. As can be seen, the second lock memory 31b does not store the first or second virtual key K1,K2 at this stage.

In <FIG>, the second virtual key K2 has been transferred from the first key memory <NUM> to the second lock memory 31b using the first key communication interface <NUM> and the second lock communication interface 32b. The second lock memory 31b, therefore, stores the second virtual key K2. The second lock 3b may then be actuatable between its first and second conditions - as discussed herein.

Accordingly, the same first key <NUM> may be used to actuate a plurality of locks (e.g. the first and second locks <NUM>,3b).

In <FIG>, the first key <NUM> (now not storing the first or second virtual key K1,K2) is used to retrieve the first virtual key K1. Accordingly, the first key <NUM> is positioned to communicate with the first lock <NUM>. The first virtual key K1 is transferred (again using the communication interfaces <NUM>,<NUM>) from the first lock memory <NUM> to the first key memory <NUM>, this may be permitted on actuation of the first lock <NUM> between the first and second conditions.

As can be seen in <FIG>, the first virtual key K1 may be transferred so that it is stored in the first key memory <NUM> and is no longer stored in the first lock memory <NUM>.

As can be seen in <FIG>, the first key <NUM> may be positioned to communicate with the second lock 3b to retrieve the second virtual key K2 - which may be transferred (over the communication interfaces <NUM>,32b) from the second lock memory 31b to the first key memory <NUM> on actuation of the second lock 3b between the first and second conditions.

In some embodiments, the first key <NUM> and first lock <NUM> (and other keys and locks sharing their features and functionality) may be configured only to accept a virtual key K1,K2 if that virtual key is listed in their respective first key whitelist and first lock whitelist <NUM>,<NUM>.

In some embodiments, the first key whitelist and first lock whitelist <NUM>,<NUM> may include sequence or logic information which determines which virtual key the first key <NUM> and first lock <NUM>, as the case may be, will accept next.

If a virtual key held by the first key <NUM> not accepted by the first lock <NUM>, then actuation of the first lock <NUM> between the first and second conditions may be prohibited by that first key <NUM>. Similarly, if a virtual key held by the first lock <NUM> is not accepted by the first key <NUM>, then actuation of the first lock <NUM> by the first key <NUM> between the first and second conditions may be prohibited by that first key <NUM>.

In some embodiments, different virtual keys are required in order to actuate the first lock <NUM> from the first condition to the second condition compared to actuation of the first lock <NUM> from the second condition to the first condition. The first key <NUM> may store both one or more of these virtual keys.

In some embodiments, there may be more than a first and a second condition of the first lock <NUM> - the first lock <NUM> may have one or more further conditions and, accordingly, in some embodiments one or more virtual keys are required to transition between any two of the conditions as between the first and second condition as described herein. The above described features in relation to the first and second conditions may be replicated for any further conditions (e.g. such that the third or additional condition can be detected).

The use of virtual keys and respective whitelists <NUM>,<NUM> allows embodiments of the invention to impose sequences of operation of locks. Indeed, in some embodiments, the first lock whitelist <NUM>, for example, may indicate that multiple virtual keys are required in order actuate the first lock <NUM> between the first and second conditions. This may require the collection, by the first key <NUM>, of those virtual keys from different locations (e.g. from other locks).

The interlock system <NUM> may be a trapped key interlock system and, as will be understood, a traditional trapped key interlock uses a plurality of keys and locks to enforce a desired sequence of operations - e.g. for ensuring safe access and/or operation of equipment protected by the traditional trapped key interlock system. In embodiments, virtual keys are used to ensure that a particular key is authorised to actuate a particular lock and sequences of operation of locks may be imposed. Therefore, embodiments of the present invention may replicate some aspects of the operation of a trapped key system using one or more virtual keys.

With each exchange of a virtual key between the first lock <NUM> and first key <NUM>, one or more of the first key whitelist <NUM>, first lock whitelist <NUM>, first key lock identifier memory <NUM>, and first lock key identifier memory <NUM> may be updated to reflect the exchange.

With reference to <FIG>, the first key <NUM> and/or the first lock <NUM> may be configured to inhibit or substantially prevent full engagement therebetween unless the first key <NUM> is authorised for use with the first lock <NUM>. This authorisation may be determined by one or more of:.

The first key <NUM> and first lock <NUM> may, therefore, be partially engageable in a first position with respect to each other and only released into full engagement if it is determined that the first key <NUM> is authorised for use with the first lock <NUM>. The partially engaged position will be referred to herein a communication position and the fully engaged position will be referred to herein as an actuation position.

This may be achieved using an engagement release mechanism of either or both of the first key <NUM> and the first lock <NUM>. In the depicted embodiments, the engagement release mechanism <NUM> is provided as part of the first key <NUM>.

This communication position is sufficient (e.g. allows sufficiently close proximity) for the first key communication interface <NUM> to communicate with the first lock communication interface <NUM>. As such, in this partially engaged position the first key <NUM> can determine one or more of the first lock identifier <NUM>, the one or more virtual keys stored in the first lock memory <NUM>, the condition of the lock <NUM>, one or more virtual keys required to actuate the first lock <NUM>, and the like. Similarly, the first lock <NUM> may be configured to determine one or more of the first key identifier <NUM>, the one or more virtual keys stored in the first key memory <NUM>, and the like.

In some embodiments, an indication of the or each virtual key which the first lock <NUM> requires for its actuation may be communicated, via the first lock communication interface <NUM> and first key communication interface <NUM>, to the first key <NUM>. The first key <NUM> may determine whether it has stored thereon any one or more virtual keys which are required to actuate the first lock <NUM> (this determining may be made by the first key controller <NUM>). If so, then one or more of these keys may be transferred to the first lock <NUM> and/or may be determined to be the authorised key.

If the communication results in the first key <NUM> (or first lock <NUM> in some embodiments) determining that the first key <NUM> is authorised to actuate the first lock <NUM>, then the engagement release mechanism <NUM> is operated to allow the first key <NUM> to engage fully with the first lock <NUM> and, therefore, to actuate the first lock <NUM> between the first and second conditions.

In the depicted embodiment of <FIG>, the engagement release mechanism is provided as part of the first key <NUM>.

The first key <NUM> may comprise a housing <NUM>. In some embodiments, and as depicted, the housing <NUM> form the first key head <NUM> and serves as a collar for the first key shaft <NUM>. Accordingly, in this and some other embodiments, the first key <NUM> housing <NUM> includes a collar <NUM> which at least partially surrounds the first key shaft <NUM>.

The first key shaft <NUM> may be keyed to be at least partially received by the first key receiving aperture <NUM> of the first lock <NUM>. The collar <NUM> of the first key <NUM> is configured to fit around at least a portion of a housing <NUM> of the first lock <NUM> in the region of the first key receiving aperture <NUM>. In some embodiments, the housing <NUM> of the first lock <NUM> includes a raised cylindrical portion <NUM> through which is defined the first key receiving aperture <NUM>. The collar <NUM> of the first key <NUM> may be configured to fit around the raised cylindrical portion <NUM> and this may be a close fit. Accordingly, the collar <NUM> may have a generally circular cross-section. A central longitudinal axis of the first key shaft <NUM> may be generally aligned with a central longitudinal axis of the collar <NUM>.

The first key shaft <NUM> may define a pin receiving hole <NUM> which may be located along the central longitudinal axis of the first key shaft <NUM>. The pin receiving hole <NUM> may be configured to receive a pin <NUM> which may extend from within the first key <NUM> towards the end of the first key shaft <NUM>. In some embodiments, the pin <NUM> does not extend beyond an end of the first key shaft <NUM>. The pin <NUM> may, therefore, be positioned within the first key shaft <NUM>.

The pin <NUM> is coupled to a pin movement mechanism <NUM>. The pin movement mechanism <NUM> is configured to move the pin <NUM> between a retracted and an extended position with respect to the first key shaft <NUM>. In the extended position, a distal end of the pin <NUM> is closer to the end of the first key shaft <NUM> than in the retracted position. Accordingly, in the retracted position, a portion (or greater portion) of the pin receiving hole <NUM> is accessible from outside of the first key <NUM>.

The pin movement mechanism <NUM> may include a resilient biasing arrangement which is configured to bias the pin <NUM> into the extended position. The pin movement mechanism <NUM> may include a solenoid 218a which is configured to drive a lock mechanism 218b to lock the pin <NUM> in the extended position.

The engagement release mechanism <NUM> may, therefore, comprise one or both of the pin <NUM> and the pin movement mechanism <NUM>.

The first key <NUM> may further include a power supply <NUM> which is configured to power one or more components of the first key <NUM>. The power supply <NUM> may be in the form of a battery or may be a connector for coupling to an external source of electrical power.

The first key <NUM> may include circuitry (e.g. on a printed circuit board) which may provide, for example, the first key memory <NUM>, the first key communication interface <NUM>, the first key controller <NUM>, the first key whitelist <NUM>, the first key identifier memory <NUM>, the first key lock identifier memory <NUM>, and/or the lock update memory <NUM>.

In some embodiments, the first key communication interface <NUM> includes a communication element 22a which is located in the region of the collar <NUM> and/or the first key shaft <NUM>. In some embodiments, the communication element 22a is located within the collar <NUM>.

The communication element 22a may be an antenna and may be in the form of a coil. In some embodiments, the communication element 22a comprises one or more electrical contacts. The communication element 22a may be provided within the collar <NUM> in the sense that it is within a volume at least partially defined by the collar <NUM> (which may be the same volume in which the first key shaft <NUM> is located) or may be embedded within the material of the collar <NUM>. In some embodiments, the collar <NUM> includes at least one internal slot in which the communication element 22a is substantially located.

In some embodiments, the first key communication interface <NUM> may include more than one such communication element 22a - which may be spaced apart around the collar <NUM>, for example.

As mentioned above, the first lock <NUM> may include a raised cylindrical portion <NUM> of the housing <NUM>, thereof, about which the collar <NUM> of the first key <NUM> is configured to at least partially fit.

The housing <NUM> of the first lock <NUM> may include a plurality of housing parts - of which the raised cylindrical portion <NUM> is one. The raised cylindrical portion <NUM> may be provided as a portion which is removable from a main body <NUM> of the housing <NUM> - removal may, however, require one or more specialist tools.

The main body <NUM> of the housing <NUM> and the raised cylindrical portion <NUM> may define therebetween a lock cylinder cavity in which a lock cylinder member <NUM> is provided. The lock cylinder member <NUM> may be rotatable within the housing <NUM> (with respect thereto).

The lock cylinder member <NUM> may be actuatable (e.g. rotatable) with respect to the housing <NUM> between at least two positions - each position representing one of the two conditions of the first lock <NUM>. Therefore, in the first condition, the lock cylinder member <NUM> may be in a first position with respect to the housing <NUM> and, in the second condition, the lock cylinder member <NUM> may be in a second position with respect to the housing <NUM> - the first and second positions being different.

The lock cylinder member <NUM> may include one more features configured to engage one or more features of one or more actuators <NUM> which are controlled by operation of the first lock <NUM> (e.g. such that the one or more actuators <NUM> are in a first operating state when the first lock <NUM> is in the first condition and in a second operating state when the first lock <NUM> is in the second condition). The operating state may be, for example, operating or stopped or disconnected or connected or the like.

Accordingly, irrespective of the configuration of the first lock <NUM>, the first lock <NUM> may be configured to operate one or more actuators <NUM> between operating states thereof.

The lock cylinder member <NUM> may include a protrusion <NUM> which is positioned with respect to the first key receiving aperture <NUM> such that, when the first key <NUM> is in the communication position, the end of the pin <NUM> abuts the protrusion <NUM>. Accordingly, the protrusion <NUM> may extend into a portion of the lock cylinder cavity which is configured to receive at least part of the first key <NUM> (e.g. at least the portion of the first key shaft <NUM>. The protrusion <NUM> may be such that, with the pin <NUM> in the extended position, the first key <NUM> is inhibited or substantially prevented from actuating the first lock <NUM> but with the pin <NUM> in the retracted position, the first key <NUM> is substantially free to actuate the first lock <NUM>.

The lock cylinder member <NUM> may include one or more key abutment members <NUM> which are configured to abut a portion of the first key <NUM> (e.g. a part of the first key shaft <NUM>) when received by the first lock <NUM> with the first key <NUM> in the actuation position with respect to the first lock <NUM>. The or each key abutment member <NUM> may be configured to transfer movement (e.g. rotational movement) of the first key <NUM> (e.g. the first key shaft <NUM>) to the lock cylinder member <NUM>.

Accordingly, in some embodiments, the fist key shaft <NUM> includes at least one key protrusion 212a,b which extend away from the longitudinal axis of the first key shaft <NUM> and which may extend generally perpendicular to that axis.

A first 212a of the at least one key protrusion may be configured to be received between two key abutment members <NUM> - such that rotation of the first key shaft <NUM> in either direction will cause the first key protrusion 212a to abut a respective one of the key abutment members <NUM> to drive rotation of the lock cylinder member <NUM> in a respective direction.

The lock cylinder member <NUM> be further associated with one or more plates <NUM> of the first lock <NUM>. The or each plate <NUM> provides a different functionality to the first lock <NUM>. The or each plate <NUM> may be located between a face of the lock cylinder member <NUM> and an internal face of the raised cylindrical portion <NUM> of the housing <NUM> of the first lock <NUM>.

The or each plate <NUM> may be configured for rotation with the lock cylinder member <NUM>. In some embodiments, the or each plate <NUM> is restricted from rotation with the lock cylinder member <NUM> and this may mean that the or each plate <NUM> does not rotate with the lock cylinder member <NUM> or that rotation with the lock cylinder member <NUM> is restricted to just a portion of the total rotational freedom of the lock cylinder member <NUM> (with respect to the housing <NUM>).

The or each plate <NUM> may include one or more warding plates and/or coding discs. In some embodiments, one or more linear or radial pin tumblers may be provided for a similar functionality.

A first plate 317a is, in some embodiments, located adjacent the lock cylinder member <NUM>. The first plate 317a defines one or more tamper prevention pin receiving recesses <NUM>. The or each tamper prevention pin receiving recesses <NUM> is configured to receive at least part of at least one tamper prevention pin <NUM>. The or each tamper prevention pin <NUM> configured to hinder or substantially prevent rotation of the lock cylinder member <NUM> by a key which is not the first key <NUM> (or by some other object). Accordingly, the or each tamper prevention pin <NUM> may be housed at least partially within the lock cylinder member <NUM> and biased towards a position in which they extend out thereof. A resilient biasing arrangement may be provided as part of the lock cylinder member <NUM> to achieve this (the resilient biasing arrangement may include at least one spring, such as a helical spring). With the or each tamper prevention pin <NUM> in its extended position, the or each tamper prevention pin <NUM> may be at least partially received by a respective one of the tamper prevention pin receiving recesses <NUM> of the first plate 317a. This engagement and abutment of the first plate 317a with the housing <NUM> (e.g. at an outer edge of the first plate 317a) may hinder or substantially prevent rotation of the lock cylinder member <NUM> with respect to the housing <NUM>.

When the first key <NUM> is in the actuation position, a part of the first key <NUM> (e.g. the first key protrusion 212a) may engage the or each tamper prevention pin <NUM> and move the or each tamper prevention pin <NUM> against the biasing force into a respective retracted position - in which the or each tamper prevention pin <NUM> is not received by a respective one of the tamper prevention pin receiving recesses <NUM>. This, in turn, allows rotation of the lock cylinder member <NUM> with respect to the housing <NUM>.

In some embodiments, there are at least two such tamper prevention pins <NUM>. The first plate 317a may include a plurality of possible rotational positions with respect to the lock cylinder member <NUM> in which the tamper prevention pins <NUM> may be received (at least partially) by the tamper prevention pin receiving recesses <NUM>. This is intended, to hinder or substantially prevent a foreign object or incorrect key from operating the first lock <NUM>.

The first key <NUM> may be configured to move the or each tamper prevention pin <NUM> into the retracted position only when the pin <NUM> thereof is in the retracted position. With the pin <NUM> of the first key <NUM> in the extended position, the first key <NUM> may be held apart from the tamper prevention pin or pins <NUM> (or held such that the first key <NUM> is generally prevented from moving the or each tamper prevention pin <NUM> into the retracted position). Accordingly, if the pin <NUM> of the first key <NUM> is in the extended position, the first key <NUM> is in the communication position with respect to the first lock <NUM> but with the pin <NUM> in the retracted position, the first key <NUM> may move into the actuation position - in which the first lock <NUM> can be actuated by the first key <NUM>.

The one or more plates <NUM> may include a second plate 317b. This second plate 317b may be positioned between the first plate 317a and the internal face of the raised cylindrical portion <NUM> of the housing <NUM> of the first lock <NUM>. The second plate 317b may, for example, define a plurality of different possible first key <NUM> orientations with respect to the first lock <NUM> - i.e. rotational positions about the longitudinal axis of the first key shaft <NUM> - and may, therefore, define a plurality of paths through which the first key <NUM> (or a part thereof) may pass.

The one or more plates <NUM> may include a third plate 317c which is configured to define the orientation of the first key <NUM> with respect to the first lock <NUM> when last removed from the first lock <NUM>. Thus, this third plate 317c may be configured to rotate with the lock cylinder member <NUM> and define a single path through which the first key <NUM> (or a part thereof) may pass. The third plate 317c may be located between the second plate 317b and the internal face of the raised cylindrical portion <NUM> of the housing <NUM> of the first lock <NUM>. The rotation of the third plate 317c may be caused by engagement of the third plate 317c with a part of the first key <NUM> - such as the second key protrusion 212b.

Some embodiments may further include a user interface device <NUM>, see <FIG>. The user interface device <NUM> may be a computing device - including, for example, a processor, memory, and the like. The user interface device <NUM> may be portable such that it can be carried manually.

The user interface device <NUM> may be communicatively coupled to the first key <NUM>. This communicative coupling may be through a wired or wireless link provided by a communication module <NUM> of the user interface device <NUM>. The first key <NUM> may include a first key communication module <NUM> which is configured to communicate with the communication module <NUM> of the user interface device <NUM> and this may use a different form of communication to the first key communication interface <NUM>. The communication module <NUM> and first key communication module <NUM> may be a serial communication interface which may use the universal serial bus, and/or may be through an RS232 connector. The communication module <NUM> and first key communication module <NUM> may use a wireless protocol such as Bluetooth, NFC, Wi-Fi, or the like.

The communication module <NUM> may be configured to communicate with one or more other components of the interlock system <NUM> which may include one or more other user interface devices and/or one or more other keys and/or locks.

The user interface device <NUM> includes a display screen <NUM> which is configured to display information to an operator. This information may include, for example instructions to the operator regarding use of the first key <NUM>. In a system in which there is a plurality of locks, then the information may include instructions as to which of the plurality of locks to actuate using the first key <NUM>.

The user interface device <NUM> may be configured to receive one or more of the first key identifier, one or more virtual keys stored by the first key <NUM> in the first key memory <NUM>, the condition of the first lock <NUM>, and the whole or part of the first key whitelist <NUM>, for example. These are examples of the data which may be received by the user interface device <NUM>, this data may include any data held by the first key <NUM> or received by the first key <NUM> from the first lock <NUM>.

The data which is passed from the first key <NUM> to the user interface device <NUM> may include information regarding a lock with which the first key <NUM> is currently engaged. This may include the first lock identifier for the lock with which the first key <NUM> is currently engaged. This may include indications of one or more virtual keys which are required to actuate the first lock <NUM> (i.e. the lock with which the first key <NUM> is engaged) - this may be the whole or part of the first lock whitelist <NUM>, for example.

The user interface device <NUM> may be configured to determine whether the lock with which the user is currently attempting to engage the first key <NUM> (e.g. with the first key <NUM> in the communication position with respect to the lock) is the correct lock. The correct lock may be determined by checking whether the lock is configured to be actuated by the first key <NUM> based on one or more virtual keys held on the first key <NUM> or one or more virtual keys listed in the lock whitelist for that lock. In addition or alternatively, in some embodiments, the correct lock is determined by comparing the identifier for that lock with the expected identifier in accordance with a predefined lock sequence. The user interface device <NUM> may be configured to display, using the display screen <NUM>, an indication of whether the lock is the correct lock. The correct lock and key may be determined using the same processes as described above for determining whether the first key <NUM> is moveable from the communication to the actuation position.

In some embodiments, the user interface device <NUM> is configured to receive one or more fault codes issued by the first key <NUM> or the first lock <NUM> (which may be configured to issue a fault code on detection of a fault). The user interface device <NUM> may be configured to alert the user to the fault by, for example, displaying an indicator on the display screen <NUM>. The first key <NUM> and/or first lock <NUM> may, therefore, include a diagnostic function in which one or more faults can be detected and reported, for example.

In some embodiments, the user interface device <NUM> includes details of one or more user accounts - each account being associated with respective login details. Accordingly, the operational history of one or both of the user interface device <NUM> and/or the first key <NUM> may be associated with a user account for the user logged in when the relevant event or events occurred. In this instance, an event may include any data received by or determined by the user interface device <NUM> (this may include which lock a particular key has been used with and when, and/or which keys have operated a particular lock and when). The user interface device <NUM> may include, accordingly, an archive which includes details of its operation and/or the operation of one or more keys and/or locks associated therewith. This archive may be transmitted (e.g. using the communication module <NUM>) to another part of the interlock system <NUM>.

The user interface device <NUM> may be configured to display, using the display screen <NUM>, one or more sequences of operation - i.e. one or more sequences of lock with which the first key <NUM> must be operated. The or each sequence may be determined by the user interface device <NUM>, input by a user, and/or received by the user interface device <NUM> from another part of the interlock system <NUM>.

In some embodiments, the user interface device <NUM> includes a power source <NUM> which may be in the form of a battery or a connection to an electrical supply. In some embodiments, the power source <NUM> of the user interface device <NUM> is also the external power supply for the first key <NUM> - and may be connected to the power supply <NUM>.

In some embodiments, data stored on the first key <NUM> and/or first lock <NUM> and/or user interface device <NUM> may be encrypted. This may include the or each virtual key and/or identifier for the first key <NUM> and/or the first lock <NUM>.

In some embodiments, one or more components of the first key <NUM> and/or first lock <NUM> and/or user interface device <NUM> may be duplicated in order to provide redundancy. During operation, each duplicate component may be mirrored - i.e. changes thereto are duplicated across the duplicate components.

An operational example implementation of some embodiments of the present invention is described with reference to <FIG>.

In this example, an interlock system <NUM> is provided. This system <NUM> is configured for use with - merely by way of an example - an electrical transformer <NUM>. The electrical transformer <NUM> is one example of a potentially dangerous item of equipment with which embodiments of the present invention may be used.

The electrical transformer <NUM> is configured to receive electricity of a high voltage from one of two available high voltage transmission lines 12a,12b. Each of the high voltage transmission lines 12a,12b is associated with a respective isolator device 13a,13b. The electrical transformer <NUM> should be connected only to one of the two high voltage transmission lines 12a,12b at a time and the isolator devices 13a,13b act to connect or disconnect each high voltage transmission line 12a,12b from electrical communication with the electrical transformer <NUM>.

The electrical transformer <NUM> is provided, in this example system <NUM>, within an enclosure having a door <NUM>. Operation of a lock of the door <NUM> is controlled by the interlock system <NUM>.

An output from the electrical transformer <NUM> is a low voltage output line <NUM> which may be connected in electrical communication with equipment forming an electrical load. The electrical load can be disconnected from the electrical transformer <NUM> by an output isolator device <NUM>.

The correct sequence of operation to gain access to the electrical transformer <NUM> (e.g. for maintenance or inspection) is to actuate the output isolator device <NUM> to disconnect the electrical load from the electrical transformer <NUM>, to actuate the isolator devices 13a,b to disconnect the high voltage transmission lines 12a,b from the electrical transformer <NUM>, and only then to allow the door <NUM> to be unlocked so that it can be opened.

As will be understood from the above, only one of the isolator devices 13a,b is to be in its on state at any one time - the other isolator device 13a,b being in its off state to avoid both high voltage transmission lines 12a,b being connected to the electrical transformer <NUM> at the same time.

Accordingly, actuation of the first and second isolator devices 13a,b may be achieved using respective locks of the same type as the first lock <NUM>. Both of these locks <NUM> are configured to require a first virtual key in order to actuate the isolator device 13a,b from the off to the on state. So, for example, in normal operation, that first virtual key may be stored in the first lock memory <NUM> of the lock <NUM> associated with the first isolator device 13a which is in the on state. There is only one first virtual key in this system <NUM> and so the lock associated with the second isolator device 13b must be in a condition such that the second isolator device 13b is in its off state.

An operator may wish to change which of the two high voltage transmission lines 12a,b provides electricity to the electrical transformer <NUM>. In some embodiments, the operator may enter this wish into the user interface device <NUM> which may then display instructions for the operator to follow.

The operator may take the first key <NUM> and engage that first key <NUM> with the lock <NUM> associated with the first isolator device 13a. The first key <NUM> may be recognised as authorised and, after initial placement in the communication position, may move to the actuation position. The first key <NUM> can then be operated to actuate that lock <NUM> to change the condition of the lock <NUM> to actuate the first isolator device 13a to its off state. This process also results in the transfer for the first virtual key from the lock memory <NUM> of that lock <NUM> to the first key memory <NUM>.

The first key <NUM> can then be removed from that lock <NUM> and engaged with the lock <NUM> associated with the second isolator device 13b. Again, the first key <NUM> is recognised as authorised and moves from the communication position to the actuation position. The operator can now use the first key <NUM> to actuate that lock <NUM> to change its condition and to actuate the second isolator device 13b to its on state. This process also transfers the first virtual key from the first key memory <NUM> to the lock memory <NUM> of that lock <NUM>.

The operator may wish to access the electrical transformer <NUM> for maintenance or inspection, for example. As a result, the operator may need to open the door <NUM>. The operator, again, may enter this wish into the user interface device <NUM> which may display instructions for the operator to follow.

The operator may use the first key <NUM> in conjunction with the lock <NUM> associated with the output isolator device <NUM> to disconnect the low voltage output line from electrical communication with the electrical transformer. The output isolator device <NUM> in its normal on state, the lock memory <NUM> of the associated lock <NUM> may store a second virtual key. Therefore, the operator can use the first key <NUM> to collect the second virtual key from that lock <NUM> by moving the first key <NUM> to the communication position with respect to that lock <NUM>. As the first key <NUM> is authorised, the first key <NUM> then moves to the actuation position at which the operator can actuate the lock <NUM> to change its condition and actuate the output isolator device <NUM> to its off state. This process also results in the transfer of the second virtual key from that lock <NUM> to the first key memory <NUM>.

The operator will need to identify the isolator device 13a,b which is currently in its on state. The user interface device <NUM> may, for example, display this information on the display screen <NUM> thereof. The operator can then use the first key <NUM> (as described above) to collect the first virtual key from the lock <NUM> associated with the isolator device 13a,b which was in the on state. This will actuate that lock <NUM> to a different condition and the associated isolator device 13a,b to its off state. Thus, both isolator devices 13a,b are in their respective off states.

The first key memory <NUM> now stores both the first and second virtual keys.

The lock <NUM> associated with the door <NUM> may be such that it requires both the first and second virtual keys in order to change its condition and to actuate the lock to an unlocked state (from the normal locked state). As the first key <NUM> now has both of these virtual keys it may be moved to the communication position with respect to that lock. The first key <NUM>, being authorised, is then moveable to the actuation position such that the operator can use the first key <NUM> to change the condition of that lock and unlock the door <NUM>. The first and second virtual keys are, as a result, transferred to the lock memory <NUM> of the lock <NUM> associated with the door <NUM>.

Accordingly, the use of the virtual keys in this example prevents the operator from unlocking and opening the door <NUM> until both of the virtual keys have been retrieved from the locks <NUM> associated with their respective isolator devices 13a,13b,<NUM> and all isolator devices 13a,13b,<NUM> must be in their off states.

The process is repeated in reverse order after the operator has completed their task and wishes to re-enable the electrical transformer <NUM>.

As will be appreciated, the same first key <NUM> may be used with a plurality of different first locks <NUM> in accordance with embodiment of the present invention, with one or more virtual keys providing the trapped key functionality. It will also be appreciated that multiple first keys <NUM> may be used with one or more first locks <NUM>.

In some embodiments, the first key communication interface <NUM> and first lock communication interface <NUM> may be configured such that they cannot communicate (e.g. due to limited communication range) when the first key <NUM> is not in the communication or actuation position with respect to the first lock <NUM>.

In some embodiments, the first key shaft <NUM> is keyed, mechanically, so that it will only operate with a subset of locks (the subset may include a single first lock <NUM>). This enables additional safety and security in some instances. In some embodiments, however, this is not required and there may be a plurality of keys which are mechanically configured to engage the first lock <NUM> but which are prevented from doing so if not permitted to be moved from the communication to the actuation position with respect to the first lock <NUM> - as described herein. This enables keys to be, in effect, programmed for use without any expensive key cutting process to provide the correct mechanical keying.

Embodiments have been described in relation to the exchange of one or more virtual keys which may include a transfer via a move or a copy operation.

According to the invention, by using a copy operation, rather than moving a virtual key, the first key <NUM> and/or first lock <NUM> use a check-in and check-out operation to handle the or each virtual key. Accordingly, each of the first lock and first key whitelists <NUM>,<NUM> include a check-in and check-out indication. A virtual key is, therefore, checked-out from the first key <NUM> and consequentially checked-in to the first lock <NUM> and vice versa. The check-in and check-out indication is a parameter which indicates whether a particular virtual key is checked-in or checked-out. A checked-out virtual key cannot, according to the invention, be re-checked-out. Therefore, the effect of checking in and out virtual keys is comparable to the transfer of the virtual keys by the move operation.

Actuators <NUM> have been described in general and some examples have been provided (e.g. the lock <NUM> associated with the door <NUM>, and the isolator devices 13a,b,<NUM>). The actuators <NUM> may come in many different forms and these are just examples of possible actuators <NUM>.

As will be appreciated, and as mentioned above, references to keys and locks herein are typically references to keys and locks having features and functionality of the example first key <NUM> and first lock <NUM> described herein.

Embodiments include a safety system <NUM> which may include the interlock system <NUM> described herein and/or any part thereof and/or one or more actuators <NUM> (which may or may not be viewed as part of the interlock system <NUM>). Embodiments may also include methods of operating interlock systems <NUM> and safety systems <NUM> as described herein and as would be apparent from the description of the features of the interlock systems <NUM> and/or safety systems <NUM> of embodiments. As will be appreciated, embodiments of the present invention may provide guidance for the user, via the user interface device <NUM>, to ensure correct and/or efficient operation of the interlock system <NUM> and/or safety system <NUM>.

The mechanical engagement of the first lock <NUM> and first key <NUM> ensures that accepted safety standards and equipment can continue to be used with embodiments of the invention.

The provision, in some embodiments, of a single key <NUM> which can actuate a plurality of different locks using virtual keys to ensure correct operation, means that the need for the user to carry, organise and use a plurality of different keys is reduced.

The use of virtual keys also allows for greater logging of operations of the interlock system <NUM> and/or safety system <NUM> in some embodiments.

Claim 1:
An interlock system (<NUM>) comprising:
a first lock (<NUM>) including a first lock memory (<NUM>) configured to store one or more virtual keys; and
a first key (<NUM>) including a first key memory (<NUM>) configured to store one or more virtual keys,
the first lock (<NUM>) including a first lock whitelist (<NUM>) and the first key (<NUM>) including a first key whitelist (<NUM>); wherein the first lock (<NUM>) is configured to be actuated between a first condition and a second condition, when a first virtual key (K1) stored in the first key memory (<NUM>) is transferred to the first lock memory (<NUM>) by a copy operation in which the virtual key is stored in both the first key memory (<NUM>) and the first lock memory (<NUM>), once the copy operation is complete, the copy operation further including that each of the first lock whitelist (<NUM>) and the first key whitelist (<NUM>) includes
a parameter that indicates whether a particular virtual key is checked-in or checked-out and wherein a checked-out virtual key cannot be re-checked-out, such that the first virtual key (K1) is checked-out from the first key (<NUM>) and consequentially is checked-in to the first lock (<NUM>), the first lock being configured to be actuated by engagement of the first key (<NUM>) and first lock (<NUM>), and movement of the first key (<NUM>) with respect to the first lock (<NUM>).