______________________________________                                    FUNCTION  FORMAT                                                          ______________________________________                                    Status Check                                                                        (On) (Off)                                                      Sounder Cancel                                                                      **                                                              (Keyboard                                                                 Clear)                                                                    System Off                                                                          (PW) (Off)                                                      System On (PW) (Test) (On)                                                Zone Shunt/                                                                         (PW) (Test) * Sl * Cl                                           Clear                                                                     Irregular (PW) (Off) (Time) HHMM (AM)                                     Opening   (PM)                                                            Extended  (PW) (Time) HHMM (AM)                                           Closing Time                                                                        (PM)                                                            Change of (PW) * (Time) * (O) * (P) * D * HHMM (AM)                       Schedule Time                                                                       (C)(T)(PM)                                                      Password Add                                                                        (PW) * PA * YY * Z * WWWWW                                      Password  (PW) * PD * YY *                                                Delete                                                                    ______________________________________

For the particular system described here, an asterisk is used to separate fields; however, any suitable designator will do. As can be appreciated from the above table, all transactions which change operating conditions or parameters require the initial entry of a valid password (PW) followed by the transaction code and the substantive message. For the zone shunt/clear transaction, the password is followed by depressing the "test" key, followed by either a shunt (S) entry and the zone number (e.g. S1) or a clear (C) and zone number.

The irregular opening transaction corresponds closely to the schedule change transaction described above and in greater detail hereinafter; the extended closing time transaction is also similar and need not be described in detail here. The password add and password delete transactions, described in greater detail hereinafter, have a slightly different format. To add a password, a password having authority to add other passwords is entered, followed by the transaction code. The "man number" is next entered, followed by the priority level of the password being added, and finally followed by the new password itself. The deletion of a password requires entry of a password authorized to delete other passwords, the transaction code and the man number.

Thekeyboard 76 is periodically scanned to detect entries by the subscriber; typically, the keyboard is scanned every 20 milliseconds by abasic scantimer 200, which controls the synchronous operation of the transponder unit. When the scantimer enables the keyboard output, a signal will appear on a keyboard output line 202. If a key has been entered, the signal on the line 202 will be true; conversely, if no key has been entered, the output signal on the line 202 will be false. A false signal on the line 202 will be inverted by agate 204, to actuate a noentry flag 206. A counter 208 receives the output of the noentry flag 206 and, if appropriate, signals asecond flag 210, which indicates no entry the last two scans.

If an entry has been received, as indicated by a signal on the line 202, the character entered into thekeyboard 76 is compared in acomparator 212 with the last previously entered character. The last previously entered character is stored in akeyboard buffer 214. Thescantimer 200 causes thecomparator 212 to operate synchronously with the scanning of the keyboard.

If the characters transmitted to thecomparator 212 are different, a signal is generated oncomparator output line 216 to cause the keyboard buffer to load the character received by the keyboard. However, if the characters are the same, theflag 210 must provide a positive output, indicating no entry during the last two scans, before further processing will occur. By requiring a two scan interval between the same key, it is possible to ensure that a character is actually being entered, rather than entering a second key where the subscriber has in fact only accidentally released and then immediately depressed the same key.

Thus thecomparator 212 provides an output on aline 218 if the characters in the keyboard and keyboard buffer are the same, which is combined logically with the status of theflag 210 by means of an ANDgate 220. If the output of the ANDgate 220 is true, this indicates that the last two keys entered are the same and further processing begins thereon.

The first step in the subsequent processing is to determine whether the transaction is a "clear" message; i.e., a message to clear the keyboard buffer. To determine this, acomparator 222 is provided, which receives the input from thekeyboard 76 together with the input from thekeyboard buffer 214, and these inputs are compared with a standard clear message stored in a clear message register 224, which may form a portion of the memory 82 (FIG. 3). Typically, the clear message may comprise two asterisks, although any suitable message will do. In the event that thecomparator 222 indicates that the entered message is in fact a clear message, the keyboard buffer is cleared via a signal online 226. If the message monitored by thecomparator 222 is not a clear message, a signal appears on theline 228.

If thekeyboard error flag 230 has been set, by thekeyboard 76, further processing is inhibited by means of an ANDgate 232, which provides an inversion on the input from theerror flag 230. Also, an audible sounder associated with the local alarm outputs 74 is actuated and must be turned off by clearing the keyboard as described above. However, if theerror flag 230 has not been set, a positive signal occurs on the output of thegate 232, initializing a keyboardmaximum timer 234. The keyboardmaximum timer 234 limits the time duration between successive entries on thekeyboard 76, by energizing the keyboard bufferclear line 226 when thetimer 234 times out. Typically, thetimer 234 is retriggerable and is set for a sufficiently long period to permit reasonable delays between key entries.

The output of thegate 232 is also provided to another ANDgate 236, which receives its remaining input from atransaction entry flag 238. If thetransaction entry flag 238 has not previously been set, the output of thegate 236 is false, which causes aninverter 240 to send a set signal to theflag 238. The output of thegate 236 then becomes true and further processing is permitted.

The output of thegate 236 is then provided to one input of an ANDgate 242, the remaining input of which is supplied by a numeric key output from thekeyboard 76 on aline 244. The numeric key input to thegate 242 is inverted, such that if a numeric key has been depressed a false output is received from thegate 242. If the numeric key has not been depressed, the output of thegate 242 controls the output of three AND

gates

246, 248, and 250. The remaining inputs to the AND gate 246 are provided by the "on" key from thekeyboard 76 and a "system on" latch, which may be a portion of thememory 82. Thus, if the system is on, and the keyboard on key is depressed, the output of the gate 246 becomes true and thekeyboard buffer 214 is reset. Similarly, the inputs to thegate 248 are provided from the keyboard "off" key and an inverted form of the signal from the "system on" latch. Thus, if the keyboard "off" key is depressed but the system is already off, the keyboard buffer is caused to be reset.

Finally, if the numeric key has not been depressed, and in fact the keyboard "test" key has been depressed, the output of the ANDgate 250 becomes positive. The output of the ANDgate 250 is then combined in another ANDgate 254 with the output of apre-programmed latch 256. Thelatch 256 will typically be a portion of the PROM 84 (FIG. 3). The purpose of thelatch 256 is to determine whether a keyboard test will be permitted without the entry of a password. If such testing is permitted, the output of thegate 254 will become true, suitable for further processing as discussed in connection with FIG. 6b.

However, if a numeric key has been depressed, such that the signal on theline 244 is positive, the output of the ANDgate 242 goes false. This causes a positive signal on the output of an AND gate 258, which has an inverter on the input supplied by thegate 242 and receives its remaining input from thegate 236. Thus, if a numermic key has been entered, ANDgate 236 provides a positive output indicating a transaction, and the character entered in the keyboard is loaded into thekeyboard buffer 214 via thedata path 260.

From the foregoing, it can be appreciated that valid messages are entered into the keyboard buffer for subsequent processing. The output of thegate 242 is then provided to agate 262 through an inverter. The remaining input to thegate 262 is provided by alatch 265 controlled by the keyboard, to indicate that the password field is complete, or, that the password entry is complete. Thelatch 265 will typically comprise part of the memory 82 (FIG. 3).

When the password entry is complete, and the entered password has been transmitted to the keyboard buffer, the positive output on thegate 262 energizes apassword comparison circuit 266. The password comparison circuit compares the entered password from the keyboard buffer with the existing passwords maintained in a password table 268, which may form part of the memory 82 (FIG. 3) or may be a series of registers. If the entered password from keyboard buffer does not match a password contained in the password table 268, a signal appears on a "no match" line 270, which causes abad password counter 272 to increment, and also initializes abad password timer 274. If a predetermined number of bad passwords are entered within the time duration specified by thebad password timer 274, the outputs of thebad password counter 272 and thebad password timer 274 are both positive, causing a bad password transaction to be loaded into the transactions buffer 140 (FIG. 5). Typically, three bad passwords within thirty minutes would set off a bad password transaction.

Conversely, if the entered password matches one of the passwords in the table 268, a signal appears on the "match" line 276 and thepassword comparison circuit 266 provides information as to the password priority level on its data output lines 278. A signal on the line 276 thus causes the keyboard buffer to load the password priority level therein in combination with the already entered password, and subsequent processing may be performed.

In some circumstances, it may be possible that a subscriber may be forced to enter a transaction into the system against his will, as during a hold-up or the like. To protect against such forced entries, the password table 268 may be provided with an "ambush" password. In the event that the password from thekeyboard buffer 214 matches the ambush password, a signal appears on anambush line 280, which sets an ambush flag 282 and causes the transactions buffer to load an ambush signal, which may for example be stored in the memory 82 (FIG. 3).

Referring now to FIG. 6b, once the password has been entered and accepted, the transaction entry flag has been set, and a subsequent key entered, the password entry complete line 264 provides a signal to energize acontrol code circuit 290. Thecontrol code circuit 290 operates on the information already stored in the keyboard, to provide a code to the remainder of the processing circuitry for determining the function, or transaction, to be performed. Thecontrol code circuit 290 then provides the control code information to thekeyboard buffer 214 and also provides the control code information to a sequenceselect circuit 292. Also, thecontrol code circuit 290 generates on a line 294 a signal for causing the keyboard buffer to load the control code information, and for causing the sequenceselect circuit 292 to receive the control code.

As set forth in the table above, each of the transactions illustrated includes the numeric password followed by an alpha character transaction code. Although the particular coding used is subject to great variation, and need not follow the pattern set forth hereinabove, transaction codes will typically be distinguishable from the password either by field separation or different character types. Thus, for the particular transactions set forth above, if the password field is followed by a numeric key entry, thecontrol code circuit 290 rejects the entry and sets anerror flag 296.

Once the control code has been established, and provided to the sequenceselect circuit 292, thecircuit 292 determines any changes in operating state which are to be effected locally. Thus, as shown in FIG. 6b, if the process selected by the subscriber is the process of turning the system "off" (performed when the premises are opened for normal business), the sequenceselect circuit 292 will energize aline 298. If theline 298 is actuated, and the system has not previously been turned off as manifested by the energized state of a system offflag 300, the output of an AND gate 302 (which receives the signals on theline 298 and the inverted signals from the flag 300) energizes and provides a signal on a line 304.

The signal on the line 304 causes the transaction buffer to load the "off" transaction, typically stored in thememory 82. The energized signal on line 304 also resets various flags, including the system off flag, turns off any necessary outputs, resets burglary and fire bell timers and outputs, and resets the entrance and exit delay timers. It will be appreciated that the off process is typically performed within a short period after entering the premises where the system is operating, or in the "on" state.

In some circumstances thekeyboard 76 will be located at a substantial distance from the entry point. This, it may be desirable to provide at an intermediate point means for causing additional entrance delay, which can be tied into the conventional entry delay timer and may be keyed or otherwise actuated at a point between the entry point and the keyboard. Finally, it may be desirable to automatically clear any zones which have been shunted previously. Such a provision may be provided for by the subscriber, and would typically be included in the PROM 84 (FIG. 3). Thus, if the line 304 were energized and a shunt/clear flag 306 also provided a positive output, the combination of the two would provide a positive output on an AND gate 308. This would then cause the shunted zones to be cleared, and a "clear shunted zones" transaction would be loaded in the transactions buffer for communication to the central station. From the foregoing, the manner in which the subscriber may turn the system off without communication with the central station except through thetransponder unit 70 can be appreciated. The remaining processes which may be performed by the subscriber are similarly performed without the need for direct communication between the subscriber and a central station operator, but rather may be accomplished solely through the communications line between the transponder unit and the central station unit.

Referring now to FIG. 6c, another of the sequences available to the subscriber for altering system parameters is illustrated therein. The particular sequence reflected by the circuitry shown in FIG. 6c is the schedule change process, which is entered by the message described previously, and enabled by a signal from the sequenceselect circuit 292. The schedule change process will typically be required for either permanent or temporary changes in either opening or closing time for the transponder unit and therefore the subscriber system. The related processes for irregular opening or extended closing will preferably be used for one-time changes in schedule.

Turning now to FIG. 6c, if the subscriber has entered the proper format for a schedule change, the sequence select circuit will provide a signal on a line 310, which provides one input to an ANDgate 312. The remaining input to the ANDgate 312 is provided by the system offflag 300. Thus, the system must be off before the schedule change may be entered. Again, it is to be understood that the system is off during normal working hours and on when the system is to provide the full scope of protection, even though certain functions such as day burglary and hold-up may continue to operate.

In the event the system is on when the schedule change process is requested, anerror flag 314 may be set through an inverter 316. However, if the system is off, a positive signal will be provided to akey detection circuit 318. The key detectcircuit 318 determines whether the next key entered is an asterisk, an AM or PM key, or a numeric key. If an asterisk key has been entered on thekeyboard 76, a signal is provided on aline 320. If a numeric key has been entered, a signal appears on a line 322. If an AM or PM key has been entered, a signal appears on a line 324.

If a numeric key is entered, the keyboard buffer control is caused to receive the digit entered at the keyboard. If an asterisk is entered, the end of a field is indicated and the previously entered characters are matched to the pre-defined format by means of a schedulechange formatting circuit 326. It should be understood that although the asterisk has been used here for indicating a field end, any system distinguishable character is acceptable. The schedulechange formatting circuit 326 checks to ensure that each of the fields required for the particular transaction, as set forth in the foregoing table, is satisfied, and then transmits the schedule change to the transaction buffer for communication to the central station.

In the event that the line 324 is actuated, in response to an AM or PM key, the signal is fed through a pair of ANDgates 328 and 330. The remaining input to the ANDgate 328 is provided by atransaction end flag 332, triggered by the schedule change formatting circuit. The remaining input into the AND gate 330 is provided by thetransaction entry flag 238. The output of the AND gate 330 activates a passwordlevel detector circuit 334, which determines whether the password which is attempting to enact the schedule change is of a sufficiently high priority to permit the change.

For example, the master password described above would be permitted to change the system in any desired manner acceptable to the central station. However, other employees may not need such flexibility to perform their appointed functions, and it may be useful to limit the accessibility of the alarm system for these individuals. Thus, it is useful to have a plurality of security levels. In the event that a password does not have the requisite security level, theerror flag 314 is actuated. If the password is of a sufficient level, the password level detectcircuit 334 causes a positive signal on its output which provides one input to an ANDgate 336.

In the event that thetransaction end flag 332 has been set, a signal is provided by thegate 328 to arange comparison circuit 338, which operates in a manner similar to the schedulechange formatting circuit 326. Therange comparison circuit 338 ensures that the days, hours and minutes entries are within acceptable limits, and provides the remaining input to the ANDgate 336. In the event that all fields satisfy the requisite format, the output of thegate 336 in combination with the schedulechange formatting circuit 326 causes the completed transaction to be transferred to the transactions buffer for subsequent processing as described above in connection with FIG. 5.

Although it is believed that the above-described circuitry, together with the corresponding flow diagrams attached hereto as Appendix A provides sufficient teachings for those skilled in the art to implement the remaining transaction functions in either a microprocessor or dedicated hardware embodiment, reference is now made to FIG. 6d, which illustrates in schematic block diagram form the password add and delete process noted above. The password add and delete process is for use when the subscriber wishes to designate a new individual as having authorization to enter the system and change at least some of the operating parameters of the transponder unit. As noted above, passwords may be of several levels, each higher level being given the ability to change more parameters of the operating system.

The password add and delete sequence is carried on without disclosure of the password to the central station operator. That is, the subscriber may add a password for a particular individual, or may delete the same, and the addition or deletion will be transmitted to the central station unit with a print-out of only the man number being added or deleted together with the man number of the person entering the transaction. Additional protection is provided by causing the password to be encrypted in thetransponder unit 70 before transmission to the central station, by means of theencryption circuit 150 described above in connection with FIG. 5. Security is further enhanced by associating with each password a particular man number, and then using the man number rather than the actual password in all displays of system transactions at the central station.

Thus, if an individual desires to open the system at an irregularly scheduled time, the individual enters the transaction on the keyboard in the format described in the table above, which includes his password. When the transaction is displayed at the central station to alert the central station that such an irregular opening has been performed, only the man number of the individual entering the transaction is displayed. Thus it can be seen that substantial security is provided in connection with the passwords used in the system.

In the event the subscriber desires to add or delete a password, a positive signal is provided on theline 350 of the sequenceselect circuit 292. This enables a validentry detection circuit 352 which receives the message entered from thekeyboard buffer 214. Thevalid entry circuit 352 initially determines that a password of suitable priority has been used. Typically, although not necesarily, use of the master password will be required to either add or delete other passwords. If the password is not of a suitable level, thevalid entry circuit 352 sets an error flag such aserror flag 296, which causes an indication to be made to the user, through a light, sounder or other device. If a suitable password has been used, a signal is supplied to a validformat detection circuit 354.

When thevalid format circuit 354 is enabled by thecircuit 352, the fields of the message stored in the keyboard buffer are compared to a standard format and analyzed to determine whether the transaction is a password add sequence or a password delete sequence. As can be determined from the table above, to delete a password only the man number need be entered in combination with the password delete transaction code. If a password is being added, the password level must be entered, together with the man number and the new password. The password add transaction code must, of course, also be added.

If the password delete transaction is being used, a signal of a first state will appear on theoutput 356 of theformat circuit 354. This will enable a password match and deletecircuit 358. Conversely, if the password add sequence is to be used, a signal of an opposite state will appear on theoutput line 356, to enable an add logic circuit 360. If the password delete transaction is to be performed, the entered man number is matched against the range of man numbers in the particular system. The range of man numbers is limited only by the available memory devices and need not be sequential.

The match and deletelogic 358 then determines whether the man number entered in the subscriber message matches an actual man number in the system, typically stored in thememory 82. Should the entered man number not match a man number already stored in the system, theerror flag 296 will be set. However, it will generally be the case that the entered man number will match an existing man number, whereupon the password match and deletelogic 358 will cause the password table entry for that man number to be deleted from the password table 268. Also, thecircuit 358 will cause to be loaded into the transaction buffer a password delete transaction message from thememory 82. After the transaction has been completed, the keyboard buffer is cleared and the system is permitted to continue with the next scan.

Conversely, should a password add sequence be entered, the password add logic circuit 360 will be enabled from theline 356 via aninverter 362. The logic circuit 360 then determines whether the entered password is of a valid priority type and the password priority level is acceptable, then the passwords in the existing password table are searched to determine whether the same password has been entered for a slave system or for a different man number. If the password and man number have been previously entered for a different system, the password is added simply by indicating both systems rather than the previously indicated system, and a password load transaction is loaded from thememory 82 into the transaction buffer from thememory 82. If the password has not previously been used, the add logic 360 ascertains whether a password table entry is available. If no entry is available, theerror flag 296 is set. Usually, however, room for a new entry will be available in the password table 268 of thememory 82 and the new password is caused to be added thereto by the circuit 360. The transaction buffer is then loaded with a password add message for transmission to the central station, and the keyboard buffer is cleared. It is to be remembered that the password transaction process is transmitted, as with all other messages from the transponder unit, in encrypted form to the central station.

Having fully described the one embodiment of the present invention, it is to be understood that numerous variations and equivalents which do not depart from the scope of the present invention will be apparent to those skilled in the art. These variations and equivalents are intended to be included within the scope of the present invention.