JP7498397B2 - Management System - Google Patents

Description

The technology disclosed in this specification relates to a management system that uses an anti-passback method.

Patent Document 1 discloses a management system that uses an anti-passback method. For example, in management using the anti-passback method, if two people perform authentication operations at almost the same time and one person opens a door and then closes it before the other person enters or exits, the door will be locked and the other person will not be able to enter or exit. The management system of Patent Document 1 takes exceptional measures when such an event occurs. In the exceptional measures, the management system allows a re-match in response to the authentication operation by the other person and unlocks the door.

JP 2006-138080 A

With the above technology, the other person who is unable to enter or exit the room must perform the authentication procedure again to unlock the door, which can be inconvenient for the user.

This specification provides technology to improve user convenience.

The management system disclosed in this specification comprises an electric lock capable of locking a door provided at the entrance/exit of a predetermined area, an outer acquisition device provided outside the predetermined area for acquiring user information indicating a user from a user entering the predetermined area, an inner acquisition device provided inside the predetermined area for acquiring user information indicating a user from a user exiting the predetermined area, and a communication device capable of communicating with the electric lock, the outer acquisition device, and the inner acquisition device, and the communication device executes an anti-passback method judgment using the user information received from either the outer acquisition device or the inner acquisition device, and either permits the entry or exit of the user, or does not permit the entry or exit of the user. a determination unit that determines whether the door is closed and the user is permitted to enter or exit; an unlock transmission unit that transmits an unlock instruction to the electric lock when the door is closed after the user opens the door; and a lock transmission unit that transmits a lock instruction to the electric lock when the door is closed after the user opens the door; and a count unit that starts counting a predetermined time when the user information indicating a second user is received from either the outer acquisition device or the inner acquisition device after a first user opens the door and before the door is closed, and the determination is that the second user is permitted to enter or exit, and the count unit does not transmit the lock instruction to the electric lock until the count of the predetermined time ends, even if the door is closed.

With this configuration, even if the door is closed, a locking signal is not sent to the electric lock until the count of the predetermined time has ended. That is, even if the door is closed, the door remains unlocked for a predetermined time without acquiring user information from the second user again, and the second user is permitted to enter or exit. This eliminates the need to have the inside or outside acquisition device acquire user information again, improving user convenience. For example, in a situation where a first user enters and then a second user exits, it is possible to prevent the second user from being permitted to exit. Also, for example, in a situation where a first user enters and then a second user enters, it is possible to prevent the second user from being permitted to enter.

One of the outer acquisition device and the inner acquisition device acquires the user information indicating the first user from the first user, and the other of the outer acquisition device and the inner acquisition device acquires the user information indicating the second user from the second user, and when a time difference between a timing when the one acquisition device acquires the user information indicating the first user and a timing when the other acquisition device acquires the user information indicating the second user exceeds a predetermined threshold, the counting unit may start counting the predetermined time, which is a first time, and when the time difference falls below the predetermined threshold, the counting unit may start counting the predetermined time, which is a second time longer than the first time.

The time difference falling below a predetermined threshold means, for example, that the first user enters and the second user exits almost simultaneously. In this case, the two users may pass each other, and one user may prevent the other user from entering or exiting. If the other user's entry or exit is prevented, the time from when one user closes the door to when the other user opens the door becomes relatively long. In this case, the count of the predetermined time may end before the other user opens the door. According to the above configuration, when the time difference falls below a predetermined threshold, the count is started with a relatively long second time. This makes it possible to prevent the count of the predetermined time from ending before the other user opens the door. On the other hand, when the time difference exceeds the predetermined threshold, the count is started with a relatively short first time. In a situation where the two users are unlikely to pass each other, the time during which the door is unlocked can be shortened.

When a specific acquisition device among the outer acquisition device and the inner acquisition device acquires the user information indicating the first user from the first user, the specific acquisition device continuously acquires the user information indicating the second user from the second user, and the specific acquisition device receives the user information indicating the second user from the specific acquisition device after the first user opens the door but before the door is closed, and the specific acquisition device further continuously acquires the user information indicating the third user from a third user without ending the count of the specific time after the count of the specific time has started, when the entry or exit of the third user is permitted based on the determination, the counting unit may reset the count of the specific time.

For example, a situation is assumed in which multiple users enter a predetermined area in succession. In such a situation, the door may remain open. If the door remains open even after the count of the predetermined time has ended, and the second user closes the door before the third user enters the predetermined area, the door may be locked before the third user enters the predetermined area. According to the above configuration, the count of the predetermined time is reset when the third user is permitted to enter or exit. As a result, even if the second user closes the door before the third user enters the predetermined area, the count of the predetermined time is reset and does not end. Since the count of the predetermined time does not end and the door is not locked, it is possible to prevent the third user from being unable to enter the predetermined area. In addition, even in a situation in which multiple users exit the predetermined area in succession, it is possible to similarly prevent the third user from being unable to exit the predetermined area.

When a specific acquisition device among the outer acquisition device and the inner acquisition device acquires the user information indicating the first user from the first user, the specific acquisition device continuously acquires the user information indicating the second user from the second user, and the specific acquisition device receives the user information indicating the second user from the specific acquisition device after the first user opens the door but before the door is closed, the specific acquisition device continues to acquire the user information indicating the third user from a third user without ending the count of the specific time after the count of the specific time has started, and when the entry or exit of the third user is permitted based on the judgment, the counting unit may extend the specific time with a specific value as an upper limit value.

In this configuration, when the third user is permitted to enter or exit, the specified time is extended. As a result, even if the second user closes the door before the third user enters or exits the specified area, the specified time is extended and the count does not end. Since the door is not locked before the specified time count ends, it is possible to prevent a situation in which the third user is unable to enter or exit the specified area. In addition, an upper limit is set for the extension of the specified time. It is possible to prevent the time during which the door is unlocked from being unnecessarily extended.

The communication device may further include a notification unit that issues a warning when the number of times the predetermined time is counted exceeds a predetermined number.

If the number of times the predetermined time is counted exceeds a predetermined number, it means that there is a high possibility that the door is not closing properly. With the above configuration, it is possible to issue a warning when there is a high possibility that the door is not closing properly.

The communication device may further include a first change unit that changes a flag value used in the determination when the door is closed after the user opens the door and the lock instruction is sent to the electric lock, and a second change unit that changes the flag value when the determination allows the user to enter or exit and the door remains open for a period longer than a predetermined upper limit time after the unlock instruction is sent to the electric lock.

In general, in the anti-passback method, the flag value is changed when a locking command is sent to the electric lock. However, if the door remains open for a long period of time and the flag value remains unchanged, when a user who has been permitted to enter exits after entering, the anti-passback method may not make a correct judgment due to the flag value not being changed. With the above configuration, the flag value is forcibly changed if the door remains open for a period of time that exceeds a predetermined upper limit. This makes it possible to prevent the anti-passback method from making a correct judgment due to the flag value not being changed.

The control method of the management system is also novel and useful. The communication device itself, the control method of the communication device, the computer program for the communication device, and the storage medium for storing the computer program are also novel and useful.

The configuration of the management system is shown. A block diagram of the management system is shown. 1 shows an overview of the anti-passback method. The following provides an overview of the problems with the anti-passback method. The following provides an overview of the problems with the anti-passback method. 13 shows a flowchart of an entry/exit determination process in each embodiment. 4 shows a flowchart of a locking process in each embodiment. 4 shows a flowchart of a timer process in the first embodiment. 4 shows a flowchart of an abnormality determination process in each embodiment. A specific case realized by the entrance/exit judgment process and the locking process will be described. A specific case realized by the entrance/exit judgment process and the locking process will be described. 13 shows a flowchart of a timer process according to the second embodiment. 13 shows a flowchart of a timer process according to the third embodiment. 13 shows a flowchart of a timer process according to the fourth embodiment.

(First embodiment)
(Configuration of management system 2: Figs. 1 and 2)
The management system 2 according to the present embodiment is a system that manages the entry and exit of users to a predetermined area (for example, a factory, an office). The management system 2 includes a management server 10, a terminal device 80, an outer reader 100, an inner reader 200, a door 300, an electric lock 400, and an opening/closing sensor 500. The management server 10 is a server that executes the judgment of an anti-passback method (hereinafter, anti-passback will be referred to as "APB") and controls the unlocking and locking of the electric lock 400. The outline of the APB method will be described later. The management server 10 can communicate with each device 80, 100, 200, 400, and 500. The terminal device 80 is a terminal that can communicate with the management server 10. The terminal device 80 is, for example, a desktop PC, a notebook PC, a smartphone, or the like. The door 300 is provided at the entrance of the predetermined area. The door 300 is a manual door that is opened and closed by turning a knob. In a modified embodiment, the door 300 may be an automatic door.

The outer reader 100 is provided outside a specific area. The inner reader 200 is provided inside a specific area. Each reader 100, 200 is a reader that uses NFC communication to read information stored in a contactless IC chip. The IC chip is included in an IC card 600 (see FIG. 2). A user ID (e.g., "u001") that indicates the user who carries the IC card 600 is stored in the IC chip. In a modified example, the IC chip may be provided in a mobile terminal such as a smartphone.

The electric lock 400 is a lock that can lock the door 300. When the door 300 is locked and an unlock signal indicating an instruction to unlock is received from the management server 10, the electric lock 400 unlocks the door 300. When the door 300 is unlocked and a lock signal indicating an instruction to lock is received from the management server 10, the electric lock 400 locks the door 300.

The opening/closing sensor 500 is a sensor that detects whether the door 300 is open or closed.

(Configuration of management server 10; FIG. 2)
The management server 10 includes a communication interface 12 and a control unit 30. In the following, the interface will be referred to as "I/F." The communication I/F 12 is an I/F for executing communication with other devices (e.g., the outer reader 100).

The control unit 30 includes a CPU 32 and a memory 34 that is composed of a volatile memory, a non-volatile memory, etc. The CPU 32 executes various processes (for example, the entry/exit determination process in FIG. 6 described later) according to a program 40 stored in the memory 34.

The memory 34 further stores an APB table 42 and a timer count 44. The APB table 42 is a table that stores various information used for APB method judgment (hereinafter referred to as "APB judgment"). For each of multiple users who use a specified area, the APB table 42 stores a user ID indicating the user, an entry flag, and an error flag. The entry flag indicates either "ON" indicating that the corresponding user has entered the specified area, or "OFF" indicating that the corresponding user has exited the specified area. The error flag indicates either "ON" indicating that a specified error has occurred for the corresponding user, or "OFF" indicating that a specified error has not occurred for the corresponding user. The contents of the specified error will be described later.

The timer count 44 indicates the number of times the timer has been started in the timer process of FIG. 8, which will be described later. The initial value of the timer count 44 is 0. The timer count 44 is reset, for example, by a worker who performs maintenance and inspection of the door 300.

(Outline of the APB method; Figure 3)
An overview of the APB method will be described with reference to Fig. 3. In the following, the processes executed by each CPU of each device (e.g., CPU 32 of the management server 10, etc.) may be described as being mainly each device (e.g., the management server 10, etc.) rather than being mainly each CPU, from the viewpoint of ease of understanding. In addition, the management server 10 executes communication with other devices (e.g., the outer reader 100) via the communication I/F 12. In the following, the description "via the communication I/F 12" may be omitted in order to simplify the description.

(Case A1)
This case shows a case where a user indicated by a user ID "u001" (hereinafter, referred to as "user "u001") normally enters a predetermined area. In the initial state of this case, an entry flag "OFF" is stored in the APB table 42 in association with the user ID "u001".

At T10, in order to enter a predetermined area, the user "u001" performs a touch operation to bring the IC card 600 of the user "u001" closer to the outer reader 100. As a result, the outer reader 100 reads the user ID "u001" from the IC card 600.

At T12, the outer reader 100 transmits the user ID "u001" read at T10 to the management server 10.

When the management server 10 receives the user ID "u001" from the outer reader 100 at T12, the management server 10 executes a first APB judgment at T14, which is triggered by communication with the outer reader 100. In the first APB judgment, the management server 10 identifies an entry flag stored in association with the user ID received from the outer reader 100 from the APB table 42. Then, when the identified entry flag indicates "OFF" (i.e., the fact that the user is outside the specified area is not contradicted), the management server 10 decides to permit entry of the user indicated by the user ID. On the other hand, when the identified entry flag indicates "ON" (i.e., the fact that the user is outside the specified area is not contradicted), the management server 10 decides not to permit entry of the user indicated by the user ID. In this case, the entry flag stored in the APB table 42 in association with the user ID "u001" indicates "OFF," so in the first APB judgment, the management server 10 decides to allow entry for the user "u001."

When the management server 10 determines in the first APB judgment at T14 to permit entry of the user "u001", it transmits an unlocking signal to the electric lock 400 at T16. This causes the electric lock 400 to unlock the door 300, and the user "u001" opens the door 300 and enters the specified area.

Next, when the management server 10 receives a close signal from the open/close sensor 500 indicating that the door 300 is closed, at T18, it transmits a lock signal to the electric lock 400. This causes the electric lock 400 to lock the door 300.

Furthermore, when the management server 10 receives a closed signal from the opening/closing sensor 500, it changes the entry flag stored in the APB table 42 in association with the user ID "u001" from "OFF" to "ON."

(Case A2)
This case shows a case where the entry of the user "u001" into the specified area is not completed normally. In the initial state of this case, the entry flag "ON" is stored in association with the user ID "u001" in the APB table 42. For example, the initial state of this case occurs when the user "u001" follows another user out of the specified area without performing a touch operation on the inside reader 200 (i.e., the user "u001" exits together).

T30 and T32 are the same as T10 and T12. At T34, the management server 10 executes the first APB judgment. In this case, since the entry flag stored in the APB table 42 in association with the user ID "u001" indicates "ON", the management server 10 determines in the first APB judgment not to permit entry of the user "u001" who exited with a companion.

(Case B1)
This case shows a case where the user "u001" normally exits from a predetermined area. The initial state of this case is the same as that of case A2, and the entry flag is "ON".

At T40, in order to exit the specified area, the user "u001" performs a touch operation to bring the IC card 600 of the user "u001" closer to the inside reader 200. As a result, the inside reader 200 reads the user ID "u001" from the IC card 600.

At T42, the internal reader 200 transmits the user ID "u001" read at T40 to the management server 10.

When the management server 10 receives the user ID "u001" from the inner reader 200 at T42, it executes a second APB judgment at T44, which is triggered by communication with the inner reader 200. In the second APB judgment, the management server 10 identifies an entry flag stored in association with the user ID received from the inner reader 200 from the APB table 42. Then, when the identified entry flag indicates "ON" (i.e., the fact that the user is inside the specified area is not contradicted), the management server 10 decides to permit the exit of the user indicated by the user ID. On the other hand, when the identified entry flag indicates "OFF" (i.e., the fact that the user is inside the specified area is not contradicted), the management server 10 decides not to permit the exit of the user indicated by the user ID. In this case, the entry flag stored in the APB table 42 in association with the user ID "u001" indicates "ON," so in the second APB judgment, the management server 10 decides to permit the exit of the user "u001."

T46 and T48 are the same as T16 and T18. T50 is the same as T20, except that the entry flag is changed from "ON" to "OFF".

(Case B2)
This case shows a case where the user "u001" does not normally exit from the specified area. The initial state of this case is the same as case A1, and the entry flag is "OFF". For example, the initial state of this case occurs when the user "u001" follows another user into the specified area without performing a touch operation on the outer reader 100 (i.e., the user "u001" enters together with the other user).

T60 and T62 are the same as T40 and T42. In T64, the management server 10 executes a second APB judgment. In this case, since the entry flag indicates "OFF", the management server 10 determines in the second APB judgment not to permit the exit of the user "u001" who entered as a companion.

As shown in cases A1 to B2, the APB method makes it possible to manage people who enter or exit with a companion and not permit them to enter or exit. For example, it is possible to prevent a third party from entering with a companion, stealing an IC card 600 from a user in a specified area, and then using that IC card 600 to exit. It is possible to prevent information within a specified area from being leaked.

(Problems with the APB method)
Problems with the APB method will be described with reference to Figures 4 and 5. In cases C1 and C2 in Figures 4 and 5, a management server 900 different from the management server 10 of this embodiment is used.

(Case C1; Figure 4)
In this case, it is assumed that a user indicated by a user ID "u002" (hereinafter, referred to as user "u002") enters a predetermined area following user "u001". In the initial state of this case, in the APB table 42, an entry flag "OFF" is stored in association with the user ID "u001", and an entry flag "OFF" is stored in association with the user ID "u002".

T100 to T106 are the same as T10 to T16 in FIG. 3, except that the management server 900 is used. Next, user "u001" opens the door 300. Meanwhile, in T110, user "u002" performs a touch operation on the outer reader 100. The following T112 and T114 are the same as T102 and T104, except that user ID "u002" is used. In other words, it is decided that user "u002" is allowed to enter.

In this case, user "u001" closes door 300 before user "u002", who is permitted to enter, enters the specified area. In this case, in T118, management server 900 sends a locking signal to electric lock 400. Then, in T120, management server 900 identifies user IDs "u001" and "u002", which indicate users currently permitted to enter, from APB table 42, and changes the two entry flags corresponding to the two identified user IDs from "OFF" to "ON".

User "u002" performs a touch operation again at T130 to try to enter the specified area again. The following T132 is the same as T112. At T134, the management server 900 executes a first APB judgment. At this point, the entry flag indicates "ON", so the management server 900 determines in the first APB judgment not to permit entry of user "u002".

As in this case, when user "u002" enters the designated area following user "u001", a situation may occur in which user "u002" is unable to enter the designated area even though they are not tailgated.

(Case C2; Figure 5)
In this case, it is assumed that a user "u001" enters a predetermined area and a user "u002" exits the predetermined area. In the initial state of this case, in the APB table 42, an entry flag "OFF" is stored in association with the user ID "u001", and an entry flag "ON" is stored in association with the user ID "u002".

T150 to T156 are the same as T10 to T16 in FIG. 3, except that the management server 900 is used. On the other hand, T160 to T164 are the same as T40 to T44 in FIG. 3, except that the management server 900 and user ID "u002" are used. In this case, the timing at which user "u001" performs a touch operation on the outer reader 100 at T150 is approximately the same as the timing at which user "u002" performs a touch operation on the inner reader 200 at T160. For this reason, if either user "u001" or user "u002" opens the door 300, the two will miss each other, and there is a possibility that, for example, user "u001" will prevent user "u002" from exiting.

In this case, the door 300 closes while the user "u002" is prevented from exiting. In this case, in T168, the management server 900 sends a locking signal to the electric lock 400. Then, in T170, the management server 900 changes the entry flag stored in association with the user ID "u001" from "OFF" to "ON", and changes the entry flag stored in association with the user ID "u002" from "ON" to "OFF".

User "u002" performs a touch operation again at T180 to try to exit the specified area again. The following T182 is the same as T162. At T184, the management server 900 executes a second APB judgment. At this point, the entry flag indicates "OFF," so the management server 900 determines in the second APB judgment not to permit the exit of user "u002."

As in this case, when user "u001" and user "u002" perform touch operations at approximately the same time, a situation may occur in which they are unable to exit a specified area even though they are not tailgating.

(Entry/Exit Judgment Process; FIG. 6)
The entry/exit determination process executed by the CPU 32 of the management server 10 in this embodiment according to the program 40 will be described with reference to Fig. 6. The process of Fig. 6 is started when the power of the management server 10 is turned ON as a trigger. Note that part of the process of Fig. 3 is realized by the process of Fig. 6.

In S10, the CPU 32 monitors whether a user ID is received from either the outer reader 100 or the inner reader 200. If the CPU 32 receives a user ID from either reader (YES in S10), it proceeds to S12.

In S12, the CPU 32 executes user authentication using the user ID received from any of the readers. Specifically, the CPU 32 determines that the user authentication has been successful if the received user ID matches any of the user IDs stored in the APB table 42. On the other hand, the CPU 32 determines that the user authentication has failed if the received user ID does not match any of the user IDs stored in the APB table 42. If the CPU 32 determines that the user authentication has failed (NO in S12), it skips the processes from S20 onwards and ends the process in FIG. 6. On the other hand, if the CPU 32 determines that the user authentication has been successful (YES in S12), it proceeds to S20.

In S20, the CPU 32 executes an APB determination using the received user ID. Specifically, if the received user ID is received from the outer reader 100, the CPU 32 executes a first APB determination, and if the received user ID is received from the inner reader 200, the CPU 32 executes a second APB determination.

In the next step S22, the CPU 32 determines whether or not the APB determination in S20 determined that entry or exit was permitted. If the CPU 32 determines that entry or exit was not permitted (NO in S22), it skips the processing from S30 onwards and ends the processing in FIG. 6. On the other hand, if the CPU 32 determines that entry or exit was permitted (YES in S22), it proceeds to S30.

In S30, the CPU 32 uses a signal from the open/close sensor 500 to determine whether the door 300 is currently open. If the CPU 32 determines that the door 300 is currently closed (NO in S30), it sends an unlock signal to the electric lock 400 in S32. When S32 ends, the process in FIG. 6 ends.

When the CPU 32 determines that the door 300 is currently open (YES in S30), it executes the timer process (see FIG. 8) described below in S34. When S34 ends, the process in FIG. 6 ends.

(Locking process; Figure 7)
The locking process executed by the CPU 32 of the management server 10 in accordance with the program 40 in this embodiment will be described with reference to Fig. 7. The process in Fig. 7 is triggered by the management server 10 sending an unlock signal to the electric lock 400. Note that part of the process in Fig. 3 is realized by the process in Fig. 7.

In S50, the CPU 32 monitors whether the door 300 is currently closed using a signal from the open/close sensor 500. If the CPU 32 determines that the door 300 is currently closed (YES in S50), the CPU 32 proceeds to S60.

In S60, the CPU 32 determines whether the timer has already been started in the timer process in S34 of FIG. 6 (details of which are described later in FIG. 8). If the CPU 32 determines that the timer has already been started (YES in S60), it monitors the timer for time-up in S62. Then, if the timer has time-up (YES in S62), the CPU 32 proceeds to S70.

If the CPU 32 determines that the timer has not started at the current time (NO in S60), it skips S62 and proceeds to S70.

In S70, the CPU 32 sends a locking signal to the electric lock 400. In the following S72, the CPU 32 changes one or more target entry flags in the APB table 42. The target entry flags are entry flags stored in association with user IDs indicating users whose entry or exit has been permitted in the APB judgment in S20 of FIG. 6. For example, when the process in FIG. 6 is executed for each of multiple users, in S72 the CPU 32 changes multiple target flags.

If the CPU 32 determines in the monitoring of S50 that the door 300 is currently open (NO in S50), it proceeds to S52. In S52, it determines whether the time that the door 300 has been continuously open exceeds a predetermined upper limit time (e.g., 30 seconds). If the CPU 32 determines that the time that the door 300 has been continuously open is below the upper limit time (NO in S52), it returns to monitoring of S50. On the other hand, if the CPU 32 determines that the time that the door 300 has been continuously open exceeds the upper limit time (YES in S52), it proceeds to S80.

S80 is the same as S72. That is, the CPU 32 forcibly changes the target entry flag even though the door 300 is open. For example, if the door 300 remains open for a long period of time, the target entry flag will remain unchanged, and when a user who is permitted to enter enters and then exits, the APB determination may not be performed correctly because the target entry flag has not been changed. The processing of S80 can prevent the APB determination from being performed correctly because the target entry flag has not been changed.

In the next step S82, the CPU 32 changes the error flag stored in the APB table 42 in association with the target entry flag from "OFF" to "ON". This allows the CPU 32 to store the fact that the user corresponding to the target entry flag was permitted to enter or exit, but then a specific error occurred in which the door 300 remained open for a long period of time. When either the process of S72 or S82 ends, the process of FIG. 7 ends.

(Timer processing; Figure 8)
The timer process in S34 in Fig. 6 will be described with reference to Fig. 8. In S100, the CPU 32 determines whether the timer has already started. If the CPU 32 determines that the timer has already started (YES in S100), it skips the processes in S102 and onward and ends the process in Fig. 8. On the other hand, if the CPU 32 determines that the timer has not currently started (NO in S100), it proceeds to S102.

In S102, the CPU 32 starts a timer. Specifically, the CPU 32 starts a countdown of a predetermined time (e.g., one second). In a modified example, the CPU 32 may start a countup of the predetermined time.

In the next step S104, the CPU 32 increments the timer count 44. Then, in step S110, the CPU 32 executes the abnormality determination process (see FIG. 9) described below. When the process of S110 ends, the process of FIG. 8 ends.

(Abnormality Judgment Process; FIG. 9)
The abnormality determination process of S110 in Fig. 8 will be described with reference to Fig. 9. In S120, the CPU 32 determines whether the timer count 44 has exceeded a predetermined count (e.g., 1000 times). If the CPU 32 determines that the timer count 44 is below the predetermined count (NO in S120), it skips the process of S122 and ends the process in Fig. 9. On the other hand, if the CPU 32 determines that the timer count 44 exceeds the predetermined count (YES in S120), it proceeds to S122.

In S122, the CPU 32 transmits a signal indicating a warning to the terminal device 80. As a result, the terminal device 80 reports the warning (for example, displays a message indicating the warning on the screen of the terminal device 80). When the timer count 44 exceeds a predetermined count, it means that there is a high possibility that a state in which the door does not close normally occurs. With the above configuration, it is possible to report a warning when there is a high possibility that a state in which the door does not close normally occurs. This allows the worker who receives the warning to perform maintenance and inspection of the door 300.

(Specific cases: Figures 10 and 11)
Specific cases realized by the processes in FIGS. 6 to 8 will be described with reference to FIGS.

(Case D1; FIG. 10)
In this case, it is assumed that user "u002" enters a predetermined area following user "u001" as in case C1 in Fig. 4. The initial state of the APB table 42 in this case is the same as that in Fig. 4. In addition, in the initial state of this case, the timer has not been started.

T200 to T206 are the same as T100 to T106 in FIG. 4, except that the management server 10 is used. Next, the user "u001" opens the door 300. Here, the management server 10 transmits an unlock signal to the electric lock 400 in T206. Therefore, the management server 10 starts the locking process in FIG. 7.

T210 and T212 are similar to T110 and T112 in FIG. 4, except that management server 10 is used.

When the management server 10 receives the user ID "u002" from the outer reader 100 at T212 (YES at S10 in FIG. 6), it executes user authentication using the user ID "u002" (S12). In this case, the user authentication is successful (YES at S12). Then, the management server 10 executes the first APB judgment at T214 (S20), and since the entry flag corresponding to the user ID "u002" indicates "OFF", it decides to permit entry of the user "u001" (YES at S22).

At the present time, the door 300 is open. Therefore, the management server 10 determines in T220 that the door 300 is currently open (YES in S30). The management server 10 then executes timer processing (S34). Specifically, the management server 10 determines in T222 that the timer has not currently been started (NO in S100 in FIG. 8), and starts the timer (S102).

Then, at T224, the management server 10 increments the timer count 44 (S104). Note that in this case, since the timer count 44 does not exceed the predetermined count, no warning is issued in the abnormality determination process of FIG. 9.

In this case, similar to case C1, user "u001" closes door 300 before user "u002" enters the specified area. At T230, the management server 10 determines in the locking process that door 300 is currently closed (YES in S50 in FIG. 7). At T232, the management server 10 starts monitoring for a timeout (S62).

In this case, user "u002" attempts to open door 300 before the time is up. Because the locking signal has not been sent to the electric lock 400 before the time is up (NO in S62), user "u002" can open door 300. Then, user "u002" closes door 300 after entering the specified area.

When the management server 10 determines that the time is up (YES in S62 in FIG. 7), in T244, it sends a locking signal to the electric lock 400 (S70). This causes the electric lock 400 to lock the door 300.

At next T246, the management server 10 changes the entry flags of the two targets, i.e., the entry flag "OFF" stored in association with the user ID "u001" and the entry flag "OFF" stored in association with the user ID "u002", to "ON" (S72).

This configuration can solve the problem shown in case C1 in Figure 4, where user "u002" cannot enter a specified area.

(Case D2; FIG. 11)
In this case, it is assumed that a user "u001" enters a predetermined area and a user "u002" exits the predetermined area, similar to case C2 in Fig. 5. The initial state of the APB table 42 in this case is the same as that in Fig. 5. In addition, in the initial state of this case, the timer has not been started.

T300 to T306 are the same as T150 to T156 in FIG. 5, except that the management server 10 is used. Next, the user "u001" opens the door 300. Here, the management server 10 sends an unlock signal to the electric lock 400 in T306. Therefore, the management server 10 starts the locking process in FIG. 7.

Meanwhile, at T310, user "u002" performs a touch operation on the inside reader 200. In this case, too, the timing at which user "u001" performs a touch operation on the outside reader 100 at T300 is approximately the same as the timing at which user "u002" performs a touch operation on the inside reader 200 at T310. In this case, the two users miss each other, and user "u001" who has opened the door 300 prevents user "u002" from exiting.

T312 is similar to T162 in FIG. 5, except that the inner reader 200 is used. In T314, the management server 10 executes a second APB judgment (S20), and since the entry flag corresponding to the user ID "u002" indicates "ON", it decides to permit the exit of the user "u002" (YES in S22). T320 to T324 are similar to T220 to T224 in FIG. 10.

In this case, similar to case C2 in FIG. 5, user "u001" closes door 300 before user "u002" exits the specified area. T330 and T332 are similar to T230 and T232 in FIG. 10. In this case, user "u002" attempts to open door 300 before the time is up. In this case, the electric lock 400 does not lock door 300 before the time is up. User "u002" is able to open door 300. Then, user "u002" closes door 300 after exiting the specified area.

T340 to T344 are the same as T240 to T244 in FIG. 10. In the following T346, the management server 10 changes the entry flag of the target stored in association with the user ID "u001" from "OFF" to "ON", and changes the entry flag of the target stored in association with the user ID "u002" from "ON" to "OFF" (S72).

This configuration can solve the problem shown in case C2 in Figure 5, where user "u002" is unable to exit a specific area.

(Effects of this embodiment)
For example, in the case of FIG. 10 and FIG. 11, when the door 300 is closed before the user "u002" enters or exits, a comparative example is assumed in which the user "u002" is requested to perform a touch operation again. In this comparative example, the user "u002" may feel inconvenienced by the touch operation again. In contrast, according to the configuration of this embodiment, even if the door 300 is closed, a locking signal is not sent to the electric lock 400 until the time is up (NO in S62 in FIG. 7). That is, even if the user "u002" does not perform a touch operation, the door 300 is kept unlocked for a predetermined time, and the user "u002" is permitted to enter or exit. The user "u002" does not need to perform a touch operation again, and the convenience of the user can be improved.

(Correspondence)
The management server 10, the outer reader 100, the inner reader 200, the door 300, and the electric lock 400 are examples of a "communication device", an "outer acquisition device", an "inner acquisition device", a "door", and an "electric lock", respectively. The control unit 30 that executes the process of S20 in FIG. 6, the control unit 30 that executes the process of S32, and the control unit 30 that executes the process of S34 are examples of a "determination unit", an "unlock transmission unit", and a "counting unit", respectively. The control unit 30 that executes the process of S70 in FIG. 7 is an example of a "lock transmission unit". The control unit 30 that executes the process of S72 and the control unit 30 that executes the process of S80 are examples of a "first change unit" and a "second change unit", respectively. The control unit 30 that executes the process of S122 in FIG. 9 is an example of a notification unit.

Second Example
This embodiment is similar to the first embodiment, except for the content of the timer processing.

(Timer processing; FIG. 12)
S200 is the same as S100 in Fig. 8. In S202, the CPU 32 judges whether the time difference between the timing of the APB judgment (i.e., the previous judgment) executed immediately before the APB judgment executed at the current time and the timing of the APB judgment executed at the current time (i.e., the current judgment) is below a predetermined threshold (e.g., 0.1 seconds). For example, as in case D2 in Fig. 11, the time difference between the timing of the previous judgment and the timing of the current judgment being below a predetermined threshold means that the timing when the user "u001" performs a touch operation on the outer reader 100 is approximately the same as the timing when the user "u002" performs a touch operation on the inner reader 200 at T310. When the CPU 32 judges that the time difference exceeds the predetermined threshold (NO in S202), it starts counting down a predetermined first time (e.g., 1 second) in S204. On the other hand, when the CPU 32 determines that the time difference is below the predetermined threshold (YES in S202), the CPU 32 starts counting down a predetermined second time (e.g., 2 seconds) in S206. Here, the second time is longer than the first time. After S204 or S206 ends, the CPU 32 proceeds to S208.

S208 and S210 are similar to S104 and S110 in FIG. 8. When S210 ends, the processing in FIG. 12 ends.

(Effects of this embodiment)
In a situation like case D2 in FIG. 11, if the time difference between the timing of the touch operation of the entering user "u001" and the timing of the touch operation of the exiting user "u002" becomes approximately simultaneous, the two will miss each other, and for example, the user "u001" will prevent the user "u002" from exiting. If the time that the user "u002" is prevented from exiting becomes longer, the time from when the user "u001" closes the door 300 to when the user "u002" opens the door 300 will become relatively long, and there is a possibility that the time will be up before the user "u002" opens the door 300. According to this embodiment, if the above-mentioned time difference is below a predetermined threshold and the touch operations of both users are approximately simultaneous, a countdown is started with a relatively long second time (S206 in FIG. 12). As a result, as described above, it is possible to suppress the time from being up before the user "u002" opens the door 300. On the other hand, if the time difference exceeds a predetermined threshold value and the touch operations of both are not substantially simultaneous, the countdown starts with a relatively short first time period. In a situation where it is difficult for the two to pass each other, the time during which the door 300 is unlocked can be shortened.

(Correspondence)
The first time in S204 and the second time in S206 in FIG. 12 are examples of the "first time" and the "second time", respectively.

(Third Example)
This embodiment is similar to the first embodiment, except for the content of the timer processing.

(Timer processing; FIG. 13)
S300 is the same as S100 in FIG. 8. When the CPU 32 determines that the timer has not started at the current time (NO in S300), the process proceeds to S112. S312 to S320 are the same as S102 to S110 in FIG. 8. When S320 ends, the process in FIG. 13 ends. On the other hand, when the CPU 32 determines that the timer has already started (YES in S300), the process proceeds to S302. Here, the fact that the timer has already started means that the user performed a touch operation on either the outer reader 100 or the inner reader 200 while the door 300 was open at the timing immediately before the current time. In other words, the determination of YES in S300 means that the second or subsequent user performed a touch operation on either the outer reader 100 or the inner reader 200 while the door 300 was open.

In S302, the CPU 32 determines whether the reader on which the touch operation was performed at the previous timing is the same as the reader on which the touch operation was performed at the current timing. That is, the CPU 32 determines whether the second or subsequent user performed a successive touch operation on the same reader (e.g., the outer reader 100). When the CPU 32 determines that the second or subsequent user performed a successive touch operation on the same reader (YES in S302), the CPU 32 proceeds to S304. In S304, the CPU 32 resets the timer that has already started. Specifically, the CPU 32 ends the timer that has already started and restarts the countdown of a predetermined time (e.g., 1 second). When S304 ends, the processing of FIG. 13 ends.

If it is determined that the second or subsequent users have not performed consecutive touch operations on the same reader (NO in S302), the process of S304 is skipped and the process of FIG. 13 is terminated.

(Effects of this embodiment)
A situation is assumed in which multiple users enter a predetermined area in succession. For example, in case D1 of FIG. 10, another user (e.g., user "u003" indicated by user ID "u003") performs a touch operation on the outer reader 100 following user "u002" of T210. In such a situation, the door 300 may continue to be open. If the door 300 is still open after the count-up, and user "u002" closes the door 300 before user "u003" enters the predetermined area, the door 300 is locked before user "u003" enters the predetermined area. According to the configuration of this embodiment, when user "u003", who is the second or subsequent user, is permitted to enter, the countdown of the predetermined time is reset (S304 in FIG. 13). As a result, even if user "u002" closes the door 300 before user "u003" enters the predetermined area, the time does not run out. Since the door 300 is not locked before the time is up, it is possible to prevent the occurrence of a situation in which the user "u003" cannot enter the specified area. In addition, even in a situation in which a plurality of users successively exit the specified area, it is possible to similarly prevent the occurrence of a situation in which the user "u003" cannot exit the specified area. The outer reader 100, user "u001", user "u002", and user "u003" in FIG. 10 are examples of a "specific acquisition device", a "first user", a "second user", and a "third user", respectively.

(Fourth Example)
This embodiment is similar to the first embodiment, except for the content of the timer processing.

(Timer processing; FIG. 14)
In the timer process of this embodiment, the current timer time (i.e., the predetermined time) can be extended. The timer process of this embodiment is similar to the timer process of the third embodiment (see FIG. 13) except for the difference in the process after the judgment of S302. When the CPU 32 judges that the second or subsequent user has performed the touch operation successively with the same reader (YES in S302), the CPU 32 proceeds to 402.

In S402, the CPU 32 determines whether the current timer time is below a predetermined upper limit (e.g., 5 seconds). If the CPU 32 determines that the current timer time is below the predetermined upper limit (YES in S402), the CPU 32 proceeds to S404.

In S404, the CPU 32 extends the current timer time by a predetermined number of seconds (e.g., 0.5 seconds). When S404 ends, the process of FIG. 14 ends.

If the CPU 32 determines that the current timer time exceeds the predetermined upper limit (NO in S402), it skips S404 and ends the process in FIG. 14.

(Effects of this embodiment)
In this embodiment, as in the third embodiment, it is possible to deal with a situation in which a plurality of users enter the predetermined area in succession. According to the configuration of this embodiment, when the entry of the second or subsequent user, user "u003" (see FIG. 10), is permitted, the timer time is extended (S404). As a result, even if user "u002" closes the door 300 before user "u003" enters the predetermined area, the timer time is extended and does not time out. Since the door 300 is not locked without time out, it is possible to prevent the occurrence of a situation in which user "u003" cannot enter the predetermined area. In addition, an upper limit is set for the extension of the timer time (S402). It is possible to prevent the time during which the door 300 is not locked from being unnecessarily extended.

Specific examples of the technology disclosed in this specification have been described above, but these are merely examples and do not limit the scope of the claims. The technology described in the claims includes various modifications and variations of the specific examples given above. For example, the following modifications may be adopted.

(Variation 1) The "external acquisition device" and "internal acquisition device" are not limited to readers that read out information stored in a contactless IC chip, and may be, for example, devices for acquiring a user's biometric information (e.g., fingerprint information, face image, iris information, etc.). In this variation, biometric information is an example of "user information."

(Variation 2) The abnormality determination process of S110 in FIG. 8 does not need to be executed. In this variation, the "alarm unit" can be omitted.

(Variation 3) The processes of S52, S80, and S82 in FIG. 7 do not need to be executed. In this variation, the "second change unit" can be omitted.

The technical elements described in this specification or drawings have technical utility either alone or in various combinations, and are not limited to the combinations described in the claims at the time of filing. In addition, the technologies illustrated in this specification or drawings achieve multiple objectives simultaneously, and achieving any one of those objectives is itself technically useful.

2: Management system 10: Management server 12: Communication I/F
30: Control unit 32: CPU
34: Memory 40: Program 42: APB table 44: Timer count 80: Terminal device 100: Outside reader 200: Inside reader 300: Door 400: Electric lock 500: Open/close sensor 600: IC card

Claims (5)

an electric lock capable of locking a door provided at an entrance of a predetermined area;
an outside acquisition device provided outside the predetermined area for acquiring user information indicating the user from the user who enters the predetermined area;
An inside acquisition device that is provided inside the predetermined area and that acquires user information indicating a user from a user who exits the predetermined area;
A communication device capable of communicating with the electric lock, the outer acquisition device, and the inner acquisition device,
The communication device includes:
a decision unit that executes a decision of an anti-passback method using the user information received from either the outer acquisition device or the inner acquisition device, and decides whether to permit entry or exit of the user, or not permit entry or exit of the user;
an unlock transmission unit that transmits an unlock instruction to the electric lock when the door is closed and the user is permitted to enter or exit the door;
a lock transmission unit that transmits a lock instruction to the electric lock when the door is closed after the user opens the door;
a counting unit that starts counting a predetermined time when the user information indicating a second user is received from either the outer acquisition device or the inner acquisition device after a first user opens the door and before the door is closed and the determination is that the second user is permitted to enter or exit, and the counting unit does not transmit the locking instruction to the electric lock until the counting of the predetermined time ends, even if the door is closed;
a specific acquisition device among the outer acquisition device and the inner acquisition device acquires the user information indicating the first user from the first user;
The specific acquisition device subsequently acquires the user information indicating the second user from the second user;
In a case where, after the counting of the predetermined time has started due to the reception of the user information indicating the second user from the specific acquisition device before the door is closed by the first user, the specific acquisition device continues to acquire the user information indicating the third user from a third user without ending the counting of the predetermined time, when the entry or exit of the third user is permitted in the determination, the counting unit resets the counting of the predetermined time .
Management system. an electric lock capable of locking a door provided at an entrance of a predetermined area;
an outside acquisition device provided outside the predetermined area for acquiring user information indicating the user from the user who enters the predetermined area;
An inside acquisition device that is provided inside the predetermined area and that acquires user information indicating a user from a user who exits the predetermined area;
A communication device capable of communicating with the electric lock, the outer acquisition device, and the inner acquisition device,
The communication device includes:
a decision unit that executes a decision of an anti-passback method using the user information received from either the outer acquisition device or the inner acquisition device, and decides whether to permit entry or exit of the user, or not permit entry or exit of the user;
an unlock transmission unit that transmits an unlock instruction to the electric lock when the door is closed and the user is permitted to enter or exit as determined by the determination unit;
a lock transmission unit that transmits a lock instruction to the electric lock when the door is closed after the user opens the door;
a counting unit that starts counting a predetermined time when the user information indicating a second user is received from either the outer acquisition device or the inner acquisition device after a first user opens the door and before the door is closed and the determination is that the second user is permitted to enter or exit, and the counting unit does not transmit the locking instruction to the electric lock until the counting of the predetermined time ends, even if the door is closed;
a specific acquisition device among the outer acquisition device and the inner acquisition device acquires the user information indicating the first user from the first user;
The specific acquisition device subsequently acquires the user information indicating the second user from the second user;
In a case where, after the counting of the predetermined time has started due to the reception of the user information indicating the second user from the specific acquisition device before the door is closed by the first user, the specific acquisition device continues to acquire the user information indicating the third user from a third user without ending the counting of the predetermined time, when the entry or exit of the third user is permitted in the determination, the counting unit extends the predetermined time with a predetermined value as an upper limit value .
Management system. an electric lock capable of locking a door provided at an entrance of a predetermined area;
an outside acquisition device provided outside the predetermined area for acquiring user information indicating the user from the user who enters the predetermined area;
An inside acquisition device that is provided inside the predetermined area and that acquires user information indicating a user from a user who exits the predetermined area;
A communication device capable of communicating with the electric lock, the outer acquisition device, and the inner acquisition device,
The communication device includes:
a decision unit that executes a decision of an anti-passback method using the user information received from either the outer acquisition device or the inner acquisition device, and decides whether to permit entry or exit of the user, or not permit entry or exit of the user;
an unlock transmission unit that transmits an unlock instruction to the electric lock when the door is closed and the user is permitted to enter or exit as determined by the determination unit;
a lock transmission unit that transmits a lock instruction to the electric lock when the door is closed after the user opens the door;
a counting unit that starts counting a predetermined time when the user information indicating a second user is received from either the outer acquisition device or the inner acquisition device after a first user opens the door and before the door is closed, and the determination is that the second user is permitted to enter or exit, and the counting unit does not transmit the locking instruction to the electric lock until the counting of the predetermined time ends, even if the door is closed;
a notification unit that issues a warning when the number of times the predetermined time has been counted exceeds a predetermined number ;
A management system comprising: an electric lock capable of locking a door provided at an entrance of a predetermined area;
an outside acquisition device provided outside the predetermined area for acquiring user information indicating the user from the user who enters the predetermined area;
An inside acquisition device that is provided inside the predetermined area and that acquires user information indicating a user from a user who exits the predetermined area;
A communication device capable of communicating with the electric lock, the outer acquisition device, and the inner acquisition device,
The communication device includes:
a decision unit that executes a decision of an anti-passback method using the user information received from either the outer acquisition device or the inner acquisition device, and decides whether to permit entry or exit of the user, or not permit entry or exit of the user;
an unlock transmission unit that transmits an unlock instruction to the electric lock when the door is closed and the user is permitted to enter or exit as determined by the determination unit;
a lock transmission unit that transmits a lock instruction to the electric lock when the door is closed after the user opens the door;
a first change unit that changes a flag value used in the determination when the door is closed after the user opens the door and the lock instruction is transmitted to the electric lock;
a second change unit that changes the flag value when the door is kept open for a period of time exceeding a predetermined upper limit time after the determination that the user is permitted to enter or exit and the unlock instruction is sent to the electric lock;
a counting unit that starts counting a predetermined time when the user information indicating a second user is received from either the outer acquisition device or the inner acquisition device after a first user opens the door and before the door is closed and the determination is that the second user is permitted to enter or exit, and the counting unit does not transmit the locking instruction to the electric lock until the counting of the predetermined time ends, even if the door is closed;
A management system comprising: one of the outer acquisition device and the inner acquisition device acquires the user information indicating the first user from the first user;
the other of the outer acquisition device and the inner acquisition device acquires the user information indicating the second user from the second user;
when a time difference between a timing when the one acquisition device acquires the user information indicating the first user and a timing when the other acquisition device acquires the user information indicating the second user exceeds a predetermined threshold, the counting unit starts counting the predetermined time, which is a first time;
The management system according to claim 1 , wherein, when the time difference falls below the predetermined threshold, the counting unit starts counting the predetermined time, which is a second time longer than the first time.