This invention relates to secure transport systems for the secure transport of articles of value such as banknotes, coins, identification documents, passports, tokens, certificates, licences and the like. The disclosed systems are particular well adapted for use in the servicing and replenishing of ATMs (automatic teller machines) but may also be utilised in cash-in-transit processes such as may be employed when collecting cash deposits from banks or retailers, for example. The transportation of articles of value such as cash requires high-security and fully tracked processes in order to minimise the possibilities for theft of the articles. For example, conventional processes for refilling ATMs involve transporting cash, optionally in pre-loaded ATM cassettes, to the ATM location in an armoured vehicle such as a car, truck or van. The cash is stored inside the vehicle in a secure chamber which can only be accessed through an "air lock" which is an access path having an exterior door on the outside of the vehicle, an interior door into the secure chamber, and an area between the two. An operator opens the exterior door, e.g. by way of biometric recognition or a high security key, and steps into the area between the doors. The exterior door is then closed and locked, at which point the interior door can be unlocked and opened. The operator can then entire the secure chamber, collect the cash to be loaded into the ATM, and exits the vehicle through the same path by reversing the above process. Typically, on exiting the vehicle the operator is carrying a single ATM cassette, filed with banknotes, of the type suitable for fitting into the ATM on the premise in question (e.g. correct ATM brand). Since the operator typically has to walk a distance from the vehicle to the premises (even if this is only across the pavement), for security, the ATM cassette is carried within a secure bag which comprises a rigid, locked case enclosing the ATM cassette. The secure bag is typically fitted with a protection system comprising one or more sensors for detecting attempts at tampering (e.g. opening or breaking the case). If such events are detected a degradation system is activated which destroys the cassette and its contents or at least renders them permanently unusable. This may involve, for example, penetrating the cassette, e.g. with needles or via an explosive charge, and spraying the notes with dye, ink, glue, foam and/or smart water. In other cases the notes could be physically destroyed, e.g. by shredding using a system of blades provided inside the case. The degradation systems can triggered by sensors including accelerometers, temperature sensors, acoustic sensors, etc. A variety of such protection systems are known and are available for this purpose. Upon reaching the ATM premises, the secure bag can be unlocked (without triggering the protection system) using a corresponding key which usually is held by the ATM owner, or at least kept on the ATM premises. Typically the key is electronic and communicates with the secure bag by near field contactless communication or by connecting the key to appropriate electronic contacts (e.g. plugging it into a socket provided on the bag). The bag can then be opened, the ATM cassette removed and installed in the machine. Any empty cassette can then be placed in the secure bag and the process reversed to return it to the secure vehicle. Once inside the vehicle the operator may be able to open the secure bag using another key which cannot be removed from the secure chamber of the vehicle, or alternative the secure bag may remain locked until the secure vehicle returns to the cash centre. If more than one cassette is to be loaded into the ATM (or there are multiple ATMs on site), the above process must be repeated for each cassette. Similar processes are employed when collecting cash deposits e.g. from retailers and/or banks (known as "cash-in-transit" or CIT). In this case the bank or retailer places the cash into tamper-evident bags. The operator arrives at the premises in a secure vehicle as before and brings an empty secure bag into the premises using the same process as above. This can then be opened using a key held at the premises and the tamper-evident bag(s) containing the cash are placed inside. The secure bag is then taken to the vehicle and conveyed into the secure chamber. Again, multiple trips between the vehicle and premises may be required. It would be desirable to improve the security of the system without slowing an already complex procedure and, preferably, to improve the efficiency of the process. In accordance with the present invention, a secure transport system is provided, comprising: a secure vehicle for transporting articles of value is provided, and a transport device for containing articles of value, the transport device carrying an identification code, the secure vehicle comprising:

a secure chamber for storing the articles of value in use;

an operator access path through which a person can enter and exit the secure chamber, the operator access path including an exterior door and an interior door defining a personnel area therebetween, wherein the doors are interlocked such that only one of the exterior door and the interior door can be open at any one time;

a hatch through which articles of value can be transferred into and out of the secure chamber, the hatch including an exterior door and an interior door defining a hatch area therebetween, wherein the doors are interlocked such that only one of the exterior door and the interior door can be open at any one time; wherein the hatch area is configured to accommodate the transport device therewithin;

and wherein the secure vehicle further comprises a reader adapted to detect the identification code carried by the transport device, and a controller with a memory in which the identification code of the transport device is stored, the controller being configured to identify the transport device by comparing the identification code detected from the transport device with the code stored in memory.

By "coding" the transport device to the secure vehicle in this way, the security of the system is enhanced since the identity of the transport device can be checked and functions of the system configured to perform only when the correct code is detected. However, the complexity of the process carried out by the operator(s) is not increased since the identification code is detected by the reader and does not rely upon any additional input from the operator. Further, the process can optionally be streamlined by using the detected identification code to automate certain procedures in the loading or unloading of the transport device to/from the secure vehicle and/or in the case of certain attack events as described further below.

In particularly preferred embodiments, the secure vehicle further comprises a lift mechanism adapted to engage with the transport device inside or outside the vehicle and convey the transport device out of or into the hatch area. By providing two entry/exit points, one for the operator and one for the articles of value, the operator is no longer limited to transferring articles in quantities which he himself can physically lift and carry through a conventional secure "air lock". The lift mechanism provided means that much larger quantities can be dispensed and placed onto the ground so that a single operator can then push or pull them to the premises without himself needing to lift them.

In preferred embodiments, the lift mechanism comprises at least one lifting arm configured to lift or lower the transport device between the ground and the height of the hatch area and to slide the transport device into or out of the hatch area. For example, the at least one lifting arm may be arranged to rotate about a pivot point to lift or lower the transport device, the pivot point being carried by a linear actuator configured to retract or extend the transport device into or out of the hatch area.

Advantageously, the lift mechanism further comprises a lift locking mechanism configured to lock the transport device to the lift mechanism when the lift mechanism is engaged with the transport device. This ensures that the transport device is securely held by the lift mechanism and helps prevent theft during the loading/unloading procedure. The lift locking mechanism could be controlled by a mechanical key held by a member of the crew, but more preferably the lift mechanism further comprises a lift controller configured to control the lift locking mechanism. In particularly preferred embodiments, the lift controller is configured to unlock the lift locking mechanism in response to detection of a corresponding key input, preferably an electronic key or a RFID tag, by a reader provided on the vehicle or on the transport device, whereupon the transport device is released. If the reader is provided on the transport device, the detection of the key may be communicated from the transport device to the lift mechanism wirelessly.

Thus, the lift controller may control the lift mechanism to engage with a transport device located in the hatch area, and remove the transport device from the hatch and place it on the ground outside the vehicle, throughout which the transport device is locked to the lift mechanism by the lift locking device. Once the transport device is correctly placed on the ground, a crew member can present the key to the appropriate reader causing the lift controller to release the lock such that the transport device can be disengaged from the left mechanism by the crew for use in delivering the articles of value to the desired location (e.g. ATM). Upon unlocking and disengagement, the lift controller may automatically retract the lift mechanism back into the hatch.

Preferably, the lift mechanism further comprises at least one sensor configured to detect the position of the lift mechanism, and a lift controller including a memory configured to record the detected deployment position of the lift mechanism at the point of detachment of the transport device from the lift mechanism outside the vehicle. The point of detachment of the transport device corresponds to the detection of the key input which unlocks the lift locking mechanism. By recording the deployment position in this way, when the transport device is returned to the secure vehicle, the lift mechanism can be automatically extended to the correct position for reloading of the transport device into the hatch. Thus, preferably, the lift controller is configured to return the lift mechanism to the recorded deployment position when the transport device is to be reloaded into the hatch. This approach has a number of benefits. The deployment position of the transport device relative to the secure vehicle will vary due to variations in the road surface height and any incline or presence of a raised kerb, for example. By recording the deployment position (e.g. angle and extension) of the lift mechanism when the transport device is released and then returning the lift mechanism to the same position for reloading, the operation for returning the transport device into the hatch will be streamlined and sped up. For instance, the lift mechanism will then be positioned at the correct height for an operator to straightforwardly bring the transport device into engagement with it, without needing to spend time adjusting the position of the lift mechanism to meet the transport device. This improves the ease of use of the lift mechanism from the operator's perspective as well as reducing the amount of time for which the transport device is not engaged with or contained the secure vehicle, thereby reducing the possibility of theft. The control of the lift mechanism is also non- complex and therefore fast.

A variety of sensors can be provided in the lift mechanism to detect its position, such as optical sensors, e.g. light gates such as infrared sensors, proximity sensors which detect when certain metal or magnetic components come into and out of the sensing field of the sensor, microswitch sensors which detect when certain components come into and out of contact with one another, or any combination thereof. Preferably, the lifting mechanism is adapted to engage with and convey the transport device into the hatch area only upon detection of a pre-determined identification code from the transport device, i.e. preferably an identification code which is stored in the vehicle memory as described above. Thus, the transport device can be positively identified before it is loaded into the vehicle. This is important in order to identify fraudulent substitutions of one transport device for another. Preferably the identification code carried by the transport device is unique and linked to ("coded to") the vehicle, e.g. stored in a memory of the vehicle. The reader may advantageously comprise any of:

a wireless data reader, preferably an RFID reader;

an optical reader, preferably a camera or a barcode scanner;

an infra-red sensor; or

electronic microswitches configured to engage with corresponding features on the transport device. The identification code will be provided on the transportation device in a corresponding manner, e.g. in an RFID chip, as a barcode (1 D or 2D), as an infra-red signature, etc. Several of these measures could be adopted to provide redundancy and/or to act as a cross-check. Preferably, the lift mechanism further comprises a motor powered by the vehicle (e.g. by the vehicle's battery or directly from its engine). Nonetheless, a manually-operated mechanism for operating the lift mechanism is preferably additionally or alternatively provided in case of power failure. For example this could comprise a winding mechanism or winch.

The secure vehicle preferably further comprises one or more sensors for detecting the presence of a transport device inside the hatch area, advantageously comprising any of:

a wireless data reader, preferably an RFID reader;

an optical reader, preferably a camera or a barcode scanner;

an infra-red sensor; or

electronic microswitches configured to engage with corresponding features on the transport device. In preferred examples, the exterior hatch door lock may be controlled by any of: a biometric recognition system, such as a fingerprint or iris scanner, or facial recognition;

a mechanical key; or

an electronic key.

Likewise the interior hatch door lock could controlled by any of:

a push button, preferably illuminated;

a biometric recognition system, such as a fingerprint or iris scanner, or facial recognition;

a mechanical key; or

an electronic key.

(Since the interior door can only be accessed from inside the secure compartment, the level of security required here may be lower). Preferably the controller is further adapted to for monitor and control the status of all door locks, the controller preferably being linked to an alarm system. It should be noted that the various controllers mentioned above, including the lift controller, can be provided in the form of one controller with multiple functions, or as a plurality of dedicated controllers, distributed as desired within the vehicle. In the latter case the controllers are preferably networked and under the control of a central vehicle controller.

In preferred embodiments, the transport device comprises a protection system comprising: at least one monitor adapted to detect at least one predetermined criteria indicative of an attack event, and a degradation means configured to damage the contents of the transport device upon detection of an attack event. Thus the transport device is capable of detecting potential attacks and to degrade its contents in response to a detected attack.

Advantageously the secure transport system further comprises a distance tracking system adapted to monitor the distance between the secure vehicle and the transport device having the identification code which is stored in the memory of the vehicle, and to issue instructions to the at least one monitor of the protection system of the transport device to activate the degradation means if the monitored distance exceeds a predetermined threshold. In this way the link between the transport device and the vehicle provides an additional level of security since if the transport device is moved beyond an authorised perimeter, the contents of the transport device will be automatically devalued.

In preferred embodiments, the distance tracking system comprises a vehicle location device mounted in the vehicle and a transport device location device mounted in the transport device, and a processor configured to compare the locations detected by the two location devices and to determine whether the distance between them is greater than the predetermined threshold. Advantageously, the vehicle location device and the transport device location device are GPS devices. In alternative embodiments, the distance tracking system could comprise a distance sensor configured to directly measure the distance between the secure vehicle and the transport device at any one time. Preferably, the secure vehicle and the transport device each further comprise a wireless communications module adapted for remote communication with an external device, the wireless communications module preferably being adapted to communicate via any of: a cellular telephone network, radio frequency, GPRS, or near field communication such as Bluetooth, still preferably via at least two different wireless communications means operating at different frequencies, whereby the secure vehicle and the transport device are configured to communicate with each other, optionally via an intermediate server (e.g. a control centre). The wireless communications modules can be used to send the identification code of the transport device to the vehicle, to communicate location information, to provide information as to the status and condition of the transport device, or any other data.

The transport device could be of any sort, e.g. otherwise conventional coin storage bins, or protection boxes. This is particularly the case where the secure vehicle includes a lift mechanism as described above which can be very heavy. However, the conventional process for restocking ATMs described above is slow and labour-intensive. In particular, two operators are in fact required in order to complete all the trips between the security vehicle and the premises in a reasonable time, and to ensure security of the portable bags or protection boxes. It would also be desirable to provide a less time consuming procedure whilst maintaining the strict security that is required.

Therefore in particularly preferred embodiments, the transport device is a transport device for transporting receptacles containing articles of value, comprising:

a housing supported on one or more transportation components to enable movement of the housing; the housing defining a plurality of separate storage compartments therewithin, each storage compartment being adapted to accommodate at least one receptacle in use, and each storage compartment having a respective access door provided in the housing wall through which the respective storage compartment only can be accessed from the exterior of the transport device; each access door being provided with a respective lock adapted to enable or disable opening of the door upon presentation of a corresponding key; the transport device further comprising a protection system comprising at least one monitor adapted to detect at least one predetermined criteria indicative of an attack event, and a degradation module provided in each of the storage compartments the degradation modules being configured to damage the contents of the storage compartment upon detection of an attack event.

By providing a device in which a plurality of receptacles such as ATM cassettes or tamper-evident bags can be transported between the secure vehicle and the premises, each in their own secure compartment, the speed of the cash transfer process can be significantly increased. The transport device comprises at least two secure compartments and therefore at least halves the number of trips which the operator needs to make between the secure vehicle and the premises in order to transfer all the receptacles required. Preferably the transport device comprises at least three, more preferably at least four, still preferably five and most preferably exactly five separate storage compartments. In this way multiple receptacles can be transported between the vehicle and the premises by a single operator in a single trip. The ability to carry four or five ATM cassettes is particularly preferred since the majority of ATMs are designed to hold four or five cassettes and so such a transport device would enable the machine to be completely replenished in a single trip. This reduction in trips to and from the van not only significantly increases the speed of the process but also substantially enhances security since the operator and cash are outside the premises and vehicle for a much shorter period of time. As a result it is possible for a single operator to carry out the replenishing process if desired. Since each of the secure compartments has its own individual door, opening any one of the doors will only give access to one of the compartments' contents, thereby maintaining the security level.

Further, the transport device is equipped with a protection system adapted to detect potential attacks and to degrade the contents thereof in response to a detected attack. Each of the secure compartments is provided with a degradation module (which may be different in each compartment but preferably are the same), of which examples will be given below. The at least one monitor which triggers the degradation system may be distributed between the various compartments (e.g. a monitor within one compartment may trigger the degradation system within that compartment only), or could be provided centrally (i.e. to the housing as a whole) and trigger all of the degradation modules. Preferably all of the degradation modules are activated when an attack event is detected but this is not essential.

Preferably, the device further comprises a controller in communication with each of the access door locks (which are preferably electronically controlled locks) and/or with the protection system, the controller being adapted to control locking and unlocking of each lock in response to presentation of an appropriate key, and/or to control the degradation modules in response to detection of an attack event. The controller may also have additional functionality as described further below.

Advantageously, each access door lock is responsive to two corresponding keys, namely a master key which is operative to lock and unlock all of the access door locks on the transport device, preferably simultaneously, and a standard key which is operative to lock and unlock only a single one of the access door locks on the transport device. The master key is preferably provided in a fixed manner inside the secure chamber of the secure vehicle so that the plurality of access doors can only be opened together when the transport device is safely inside the secure vehicle (as will be described further below). For example the master key (which may be an electronic fob, or similar) may be physically tied to the inside of the secure chamber. Alternatively the master key could comprise a combination of a physical (electronic) key plus confirmation from the vehicle's systems that the transport device is inside, e.g. by reading an RFID identifier from the transport device as will be described further below. The standard key(s) are typically held at the ATM premises and can only be used to open one of the plurality of doors at a time. Hence, preferably, each access door lock is configured such that upon presentation of a corresponding standard key which is operative to lock and unlock the respective access door lock, the respective access door lock will only unlock if all the other access doors on the transport device are closed and locked. This interlock between the doors is typically implemented electronically and may be managed by the controller.

The protection system can utilise many different types of sensor and/or other monitors (e.g. clocks) to detect attack events. Any such protection systems already known for use on conventional security bags can be utilised. In preferred examples, the at least one monitor comprises one or more sensors adapted to detect changes in operating parameters, preferably including any one or more of:

an accelerometer or vibration detector, e.g. adapted to detect an impact, external force applied to the transport device, dropping or cutting of the transport device;

a penetration mesh disposed across the interior wall of at least one, preferably each, of the storage compartments, comprising electrically conductive filaments, any breakage of which can be detected by an applied circuit;

a moisture or gas detector, e.g. adapted to detect ingress of fluids into the transport device, such as water, salt water, petroleum, diesel, solvents, liquid nitrogen or gas;

a temperature sensor, e.g. adapted to detect heating, burning or freezing of the transport device;

a microphone, e.g. adapted to detect vibrational sounds;

an antenna, e.g. adapted to detect radio frequency jamming signals; voltage and/or current sensors, e.g. adapted to detect the power level of an onboard power source and/or tampering or disconnection of the power source;

circuit monitoring equipment configured to detect for example, electromagnetic pulses (EMP), unauthorised access to the circuit or eavesdropping;

a timer, configured to count down a pre-set time period or to activate at a pre-determined time; and/or

a location device, preferably GPS and/or VHF tracking, configured to detect the absolute location of the transport device and/or its location relative to a known point (e.g. the secure vehicle).

Similarly, many different types of degradation methods could be employed, including all those already known in conventional security bags. In preferred examples, each of the degradation modules comprises any one or more of:

a penetration device adapted to penetrate the receptacle containing the articles of value inside the storage compartment, preferably comprising one or more needles or an explosive charge;

a reservoir containing a marking substance and a dispenser adapted to dispense the marking substance onto the contents of the storage compartment, the marking substance preferably comprising a dye, a glue, a foam, an ink, a fluid containing markers such as smart water, or any combination thereof; and/or a mechanical cutting, shredding and/or matriculation device adapted to fragment the contents of the storage compartment.

Advantageously, the transport device may further comprise a wireless communications module adapted for remote communication with an external device, the wireless communications module preferably being adapted to communicate via any of: a cellular telephone network, radio frequency, GPRS, or near field communication such as Bluetooth, still preferably via at least two different wireless communications means operating at different frequencies. Dual-frequency communication of this sort improves the resilience of the device against electro-magnetic signal jamming attacks since it is difficult for an attacker to jam both frequencies simultaneously. Preferably the communications module operates on a secure messaging protocol, e.g. utilising cryptographic "handshakes" between the two devices so as to prevent wireless hacking and/or eavesdropping.

In some preferred examples, the wireless communications module may be configured to trigger the protection system in response to receiving a remote degradation instruction. For example, a remote signal could be issued by an operator carrying a "panic button" and/or by a control centre. Alternatively the signal received could be indicative of the transport device having moved beyond an authorised boundary (e.g. from the secure vehicle), thereby triggering the protection system.

The wireless communications module may further be configured to transmit information as to the location of the transport device detected by an on-board location device, to an external device. This enables the location of the device to be tracked remotely.

Advantageously, the on-board controller is further adapted to log data from any of:

the access door locks;

the at least one monitor; and/or

the degradation modules;

and preferably to transmit the data via the wireless communications module to an external device. This enables the status of the device to be monitored remotely, and can provide information as to how the device has been attacked in the event of a theft, and whether the cash has been appropriately disabled. This can also be used to diagnose faults or false activations. As an alternative to wireless transmission, the logged data could be downloaded from the device, e.g. upon retrieval of the device into the secure vehicle.

Preferably the transport device further comprises a siren adapted to be triggered by the protection device. For example this may also be triggered by the above- described monitor(s). Alternatively or in addition this could be remotely-triggered to help locate or draw attention to the transport device if stolen.

In particularly preferred embodiments, the doors of the storage compartments are all located on the same wall of the housing, the housing preferably being substantially rectangular. This configuration improves operator access to the contents of the cassette and speeds loading/unloading. As described below this is also of particular benefit in conjunction with the presently disclosed secure vehicle of the second aspect of the invention.

Preferably, the doors of the storage compartments are located on a side wall of the housing such that ingress and egress to and from each storage compartment is substantially horizontal. This is desirable since the ATM cassettes or other receptacles can be slid into and out of the compartments horizontally which is less awkward then vertical lifting as required with most conventional secure bags.

In especially preferred implementations, each storage compartment is a substantially rectangular cuboid having a length which is greater than its height and a width which is its narrowest dimension, the storage compartments preferably being arranged with their length and width dimensions substantially horizontal in use. This is desirable since ATM cassettes are typically cuboids and hence secure compartments of this shape will accommodate the cassettes whilst not permitting significant movement thereof. Since the compartments are preferably designed to accommodate all well-known brands of ATM cassette, it may be desirable to provide for the addition of inserts which can be used to adjust the internal capacity of each compartment to the size of the ATM cassette which is to be carried. For example, each compartment could have keying features provided on its internal walls to enable the fitting of such inserts, e.g. parallel grooves on opposing walls allowing insert panels to be slid into the grooves to thereby change the internal size of the compartment. The above- described orientation of the compartments (long, narrow face lying approximately horizontal) is preferred since with the majority of ATM cassettes this will result in the stacks of banknotes standing vertically during storage in the compartment, which helps to avoid later jamming when the notes are fed out of the cassette by the ATM machine. Advantageously, the transport device comprises transport components which preferably comprise one or more wheels, tracks or rollers. The transport components are desirably configured to enhance manoeuvrability of the device so that it can be pushed/pulled and steered by just one operator. In a preferred example the device may comprise a pair of wheels at one side of the housing and a single caster wheel at the other. This three-wheeled approach helps reduce the turning circle of the device. Alternatively a second caster wheel may be added to form a four-wheeled device with improved stability. Advantageously the device further comprises a handle for pushing and/or pulling the transport device. Advantageously the fully-loaded weight of the device is designed to be sufficiently low that it can be safely moved manually by a single person, e.g. no more than 80kg.

In particularly preferred implementations, the transport device is configured as a sack truck trolley construction, the centre of gravity preferably being positioned over a pair of wheels of the device when tilted for movement. A sack truck trolley typically comprises a tall handle standing vertically when the device is at rest, with a pair of wheels at its base. A platform extends horizontally away from the wheels and the load is placed on this in use. When the trolley is to be moved, the handle is pulled so as to tip the whole construction forwards such that the platform is lifted off the floor and only the wheels make contact. The trolley can then be rolled forward by pulling the handle forwards. In the present preferred construction the principle is the same although preferably a caster wheel is provided under the platform as mentioned above so that it remains manoeuvrable even when not tipped forward.

In preferred embodiments the transport device is not motorised and is simply pushed or pulled manually by an operator. However in other cases the device could further include a motor adapted to propel the device. Preferably this would be electrically powered by the on-board battery.

The transport device could be utilised to carry any articles of value but is most preferred for use with banknotes, coins, identification documents, passports, tokens, certificates, licences or the like. The receptacles are most preferably cassettes for automatic teller machines (ATMs), or tamper-evident bags. The present invention also provides a transport assemble comprising the above described transport device and a receptacle located in one or more of the secure compartments, preferably containing articles of value.

Preferably, the transport device is configured such that all the access doors of its storage compartments can be accessed through the interior hatch door of the secure vehicle when the transport device is located in the hatch area.

Examples of transport devices and secure vehicles will now be described with reference to the accompanying drawings in which:

Figure 1 schematically shows an embodiment of a secure transport system comprising a secure vehicle and a transport device in accordance with the present invention, adjacent a premises, in plan view;

Figure 2 illustrates an embodiment of a secure vehicle and a transport device in accordance with the present invention, in cut-away side view;

Figures 3a and 3b schematically show two embodiments of a transport device in accordance with the present invention;

Figure 4 depicts one secure compartment of the transport device shown in Figure 3a, together with additional functional components;

Figure 5 shows an exemplary controller network as may be provided in the transport device of Figure 3a; and

Figure 6 shows an embodiment of a transport device in accordance with the present invention.

The disclosed secure transport system encompasses two main elements which are: a secure vehicle and a transport device for transporting the articles of value from the vehicle to the customer site. These two elements are described in more detail below.

The secure transport system provides particular benefits in the field of ATM servicing and hence the following discussion will focus on this application. However it should be understood that the disclosed system and methods can also be used in other processes, including cash-in-transit (CIT) processes.

One desirable aim which may be assisted through use of the presently disclosed transport device and/or secure vehicle is to achieve ATM servicing by moving from a two person process (as is conventional) to a one person across-the- pavement replenishment with lean, robust, sustainable and scalable processes. The provided solution will be acceptable in terms of crew safety and security and will meet customer requirements (security, reduced ATM downtime).

Figure 1 shows in plan view a secure vehicle 30 in accordance with an embodiment of the invention and a transport device 10 such as that described below with respect to Figures 3a and 3b, together forming an embodiment of a secure transport system. It will be appreciated that the secure vehicle 30 can be used instead with other transport devices such as coin collection boxes or security boxes. For illustration, the vehicle 30 is shown parked outside a premises P in which an ATM A is located through a door D.

The vehicle 30 is an cash and valuables in transit vehicle having a secure chamber 31 therewithin, in which articles of value are carried. The operator Op accesses the secure chamber 31 via an operator access path 32 or "air lock". This comprises an external door 32a, an internal door 32c and an area 32b therebetween. Only one or other of the doors can be unlocked and opened at a time. To enter the secure chamber 31 , the operator unlocks the exterior door 32a, e.g. by biometric recognition (e.g. a fingerprint scanner, iris scanner etc.) and steps into the area 32b. The exterior door 32a is then closed and locked. The interior door 32c can then be unlocked and opened allowing entry to the secure chamber 31. To exit the vehicle, the same process is reversed. Also provided is a hatch 33 via which articles of value can be transferred into and out of the secure chamber 31. The hatch 33 is preferably too small for a person to fit through but this is not essential. Again, the hatch 33 has an exterior door 33a, an interior door 33c and a hatch area 33b therebetween. Only one or other of the doors can be unlocked and opened at a time. To take a transport device loaded with articles of value out of the secure vehicle, the operator first loads the transport device (located in hatch area 33b) through interior door 33c while he is inside the secure chamber 31. The exterior door 33a is closed and locked during this process. The operator then closes and locks the interior door 33c and himself exits the vehicle via path 32 as described above. The operator then approaches the exterior hatch door and unlocks it, e.g. using biometric recognition or a high security key. The transport device can then be removed from the hatch for conveying to premises P and the exterior door 33a closed again.

The secure vehicle is further provided with a reader 35 for reading an identification code carried by the transport device 10 (represented by 36). This could take the form of a RFID chip, a barcode, an infrared signature, electronic microswitches or similar. The reader 35 will be appropriately equipped, e.g. with a RFID reader, a camera etc. A combination of such measures may be provided. The code carried by the transport device 10 preferably uniquely identifies it.

The secure vehicle is further provided with a controller 37 with a memory in which the identification code of the transport device may be stored. The controller is configured to positively identify the transport device by comparing the identification code read by the reader with the code stored in the memory. This may be required before the loading process can be activated, as described in more detail below. This helps to prevent attempted substitution of the transport device. In practice, the identification code 36 may be carried by a controller 20 of the transport device and transmitted to the secure vehicle by a wireless communications module. The memory of the controller 37 may be configured to store the identification codes of multiple transport devices, whilst the controller 37 may be able to monitor the number and status of a plurality of transport devices delivered and collected by the secure transport during the course of a day.

To enable the use of transport devices carrying a greater quantity of articles of value, which may be heavier than an operator can safely lift, a lift mechanism 34 is preferably provided for lifting the transport device into and out of the hatch 33. An example of a suitable lift mechanism will be described with reference to Figure 2 which shows a cut away side view of the rear of the secure vehicle 30 and a transport device 10 (which is preferably as described with reference to Figure 3b). Here, the lift mechanism 34 comprises one or more arms 34a (only one is shown) which are configured to engage with corresponding features 34b on the transport device 10. The lift arms are pivotably connected to a linear actuator 34c at a point 34d. In one embodiment, to lift the transport device into the hatch area 33b, the transport device is positioned adjacent the rear bumper 30a of the vehicle as shown. The external hatch door 33a is unlocked and opened. The arms 34a are then moved out of the hatch area 33b and pivoted down to engage the device 10: this is represented by position 34a(i) shown in Figure 2. The arms 34a are then pivoted up to the position indicated by 34a(ii), lifting the device 10 to the height of the hatch 33. The arms are then retracted into the hatch area by the linear actuator, bringing the transport device 10 into the hatch area. The exterior door 33a is then closed and locked. The interior door 33c can then be unlocked and opened by the operator from inside the secure chamber 31. Preferably the arrangement of the interior door 33c and the transport device 10 is such that the access doors 13a, 13b to each of its secure compartments 12a, 12b (only two are shown in Figure 2) are accessible through the interior door 33c for reloading of the transport device 10 from the secure chamber 31.

Alternatively, the lift mechanism's arms 34a may be lowered without the transport device being positioned adjacent to the rear bumper 30a of the vehicle. In this embodiment the transport device must then be docked into the arms before the lifting mechanism may lift the transport device 10 into the secure vehicle. This simplifies the loading process, as the transport device 10 does not need to be positioned accurately before the arms 34a are deployed.

Preferably, in both of the embodiments described above, the lift mechanism 34 will only load the transport device 10 into the secure vehicle if the secure vehicle's controller 37 has positively identified the transport device 10 using its identification code 36 by the reader 35.

The lift mechanism is preferably powered by the vehicle 30 (e.g. from an on-board battery or the vehicle's engine). However a manual back-up system such as a winder or winch may be provided in case of power failure.

More preferably still the secure vehicle's lift mechanism 34 includes at least one sensor 38 able to determine the angle and position of the lift arms 34a. When the transport device 10 is lifted from the secure vehicle to the ground, the secure vehicle's controller 37 may record in its memory the angle and position of the lifting arm 34a, as measured by the sensors, when the transport device is released. When the transport device must be loaded back onto the secure vehicle, the controller 37 recalls from its memory the angle and position the lifting arm 34a were previously deployed at and controls the lift mechanism 34 to return its arms to this location.

This feature allows the lift mechanism 34 to automatically account for differences in terrain when the secure vehicle 30 unloads and loads transport device 10 at different destinations. Causes of these differences in terrain include changes in road surface, inclines, road camber, kerbs etc. These differences in terrain mean that the position and angle of a transport device sitting on the ground will also change at different destinations. By recording the angle and position of the lift mechanism 34 when a transport device 10 is released (i.e. when it is sitting on the ground) the lift mechanism may be subsequently returned to this orientation when reloading the transport device 10, ensuring that the lift arms 34a are at the correct position and angle to engage or dock with the transport device 10. This approach simplifies the loading process for the operator, and reduces the time and effect required to reload a transport device 10, thereby reducing the time the transport device 10 is at risk (i.e. not in the secure vehicle 30), and improving security.

The lift mechanism's angle and position sensors 38 may include infrared sensors, metal proximity sensors, and/or micro switch sensors. The infrared sensors may use a series of light gates to indicate relative positioning of different arm components 34a. Metal proximity sensors can detect when metal components come into and out of the sensor's measuring field, i.e. by measuring the changes in magnetic, capacitive or inductive fields. Microswitch sensors detect when two components of the lift mechanism are in contact with one another. Alternatively, any other suitable sensors could be used including reed switches, reflective photocells and mercury tilt switches.

More preferably still the secure vehicle's controller may associate the angle and position data when a transport device 10 is released with the transport device's identification code 36 in its memory. Therefore, when a transport device 10 is to be loaded onto the secure vehicle 30, the secure vehicle's reader 35 may identify the transport device using its identification code 36 and look up the corresponding angle and position data when the transport device 10 was unloaded so that the lift mechanism may be automatically deployed so that the arms 34a either engage the transport device 10 , or are orientated correctly so the transport device 10 may be easily docked onto them.

Alternatively, the secure vehicle may include sensors able to determine the local position of the transport device 10 relative to the secure vehicle 30. When loading a transport device onto the secure vehicle, the sensors may determine the location of the transport device, and the secure vehicle's controller 37 may automatically adjust the angle and position of the lift arms 34a to meet the transport device. As such, the lift arms may either immediately engage the transport device, or be placed in the correct alignment for docking, i.e. the transport device only needs to be pushed in a single direction to be docked on the lift arms 34a. In all of the variants described above, preferably the lift arms 34a interface with a mount plate located on the transport device, preferably located on the top surface of the transport device, as will be described below in reference to Figure 6. More preferably still, in all embodiments, the secure transport system may include a locking mechanism 39 that secures the transport device 10 to the lift arms 34a. Prior to unloading, the locking mechanism may therefore be engaged by the operator Op within the vehicle's secure chamber 31 and subsequently released by the operator Op when the transport device 10 has passed through the interlocked hatch and has been placed on the ground. Preferably the locking mechanism is engaged and released electronically, requiring that the operator Op present an electronic key or an RFID tag. Alternatively, the locking mechanism could be operated using biometric data from the operator or a mechanical key. This process is reversed when loading a transport device into the secure vehicle 30, although the secure transport system may additionally require that the transport device be positively identified using its identification code 35 before the locks may be engaged and the transport device loaded into the secure vehicle.

When unloading a transport device, the secure vehicle's controller 37 may use the release of the locking mechanism connecting the lift arms 34a to the transport device as the cue to store the arms' final angle and position data (as described above).

This locking mechanism may be located either in the lift arms 34a or on the transport device 10 and may either be mechanical, using securing bolts which enter into recesses in either the lift arms 34a or the transport device 10, or electromagnetic, using an electromagnet located in either or both devices to attract a magnetic component located on the other device. In a preferred embodiment the locking mechanism is mechanical and consists of a plurality of securing bolts in the lift arms 34a, these securing bolts being operated by a series of actuators. When the locking mechanism is disengaged these securing bolts are retracted into the lift arms 34a. When the locking mechanism is engaged the securing bolts are pushed outwards. In this preferred embodiment the securing bolts interfit a corresponding plurality of recesses in the mount plate of the transport device as will be discussed with reference to Figure 6 below. The vehicle may be equipped with another reader 35 or another sensor adapted to detect the presence (or absence) of the transport device 10 within the hatch area 33b, and preferably to positively identify it from its code 36. This information may be transmitted back to the controller 20 on board the transport device 10 and utilised in combination with the master key retained in the secure chamber 31 to permit unlocking of the access doors only when the transport device is loaded into the hatch 33.

The vehicle may also include a location device 41 such as GPS and/or VHF tracking, configured to detect the absolute location of the transport device and/or its location relative to a known point. The secure vehicle 30 may wirelessly transmit this location data to an external device e.g. a computer within a national control centre.

Desirably the secure vehicle's controller 37 may take the form of a single controller configured to carry out all of the control functions described above. Alternatively, the secure vehicle 30 may have a distributed control architecture with separate controllers being configured to provide one or more functions for the secure vehicles. These may include: a transport device identification controller 37a configured to identify the transport device 10 before it is loaded or unloaded; a lift mechanism controller 37b configured to control the lift mechanism 34 and optionally store the position and angle data associated with the lift arms 34a; a communication controller 37c configured to interface between the secure vehicle 30 and the transport device 10 and/or other external devices, such as a computer system within a national control centre; and a locking mechanism controller 37d configured to instruct the locking mechanism 39 to engage and disengage its locks.

The following lists further preferred features of secure vehicles in embodiments of the present invention: Exterior hatch access door

Interior hatch access door

Interlocking Exterior and interior hatch doors (Preventing both doors open at the same time)

Locking system electronically monitored and linked to the alarm system Door closed status electronically monitored and linked to the alarm system

Opening of the exterior transfer hatch door Security controlled via any of the following:

o Biometric Recognition system

o High security mechanical Key

o Electronic High security Key

Opening of the interior transfer hatch door Security controlled via any of the following:

o Illuminated Push Button

o Biometric Recognition system

o High security mechanical Key

o Electronic High security Key

Powered Trolley Lifting assembly located within the transfer hatch

Loading slide, telescopic arms provide the withdrawal / retract out of and into vehicle respectively

Lifting system powered from vehicle

Manual "Wind in" facility on vehicle designed for use in the event of a vehicle power failure.

Internal Transfer hatch electronic sensors designed to detect presence of the Trolley via any of the following:

o Electronic Micro switches

o Infra-Red Sensors

o RFID sensors

Lifting arm assembly incorporating electronic sensors to detect presence of the Trolley via any of the following:

o Electronic Micro switches

o Infra-Red Sensors o RFID sensors

• ATM trolley can be replaced with Coin storage Bin for use on Non ATM replenishment services, with similar functionality as outlined above.

• System powered from vehicle, leaving an unpowered trolley (transport device) for reliability and simplicity

• Linear actuator on vehicle provides motive power for pivot

• External hatch door auto closes/opens with arm deployment.

• Alarm to notify pedestrians and other road users of deployment of lift mechanism using siren, lights or other methods.

As mentioned at the outset, the transport device 10 could take various different forms including a protection box designed to be carried by an operator, a security box or chest, or a coin collection box. However, two preferred embodiments of the transport device 10 will now be described we respect to Figure 3 to 6.

The present inventors have developed a security container (or "transport device") 10 that is capable of securely transporting and protecting a plurality of ATM cassettes (preferably up to 5) from the vehicle to the customer ATM room. The container is transported by a wheeled trolley that is preferably adapted to be piloted by a single operator working alone. The ATM cash cassettes are preferably protected using a degradation system that works for both standard and polymer banknotes. Figure 3a shows an embodiment of a transport device 10 in accordance with the present invention. The transport device 10 has a "sack truck trolley" configuration, its base resting on one or more transport components which here comprise three wheels 18a, 18b and 18c (not visible) but could alternatively comprise tracks or rollers for example. The illustrated three-wheeled arrangement is preferred for enhanced manoeuvrability, the front wheel 18a preferably being a caster wheel which can turn about the vertical axis (z-axis) to change direction. A handle 19a is provided to the rear of the device, at the base of which are the other two wheels 18b, 18c (not visible). In order to move the device 10, an operator uses the handle 19 to tilt the device 10 so that it rests on wheels 18b, 18c (not visible) only, and can then be pushed or pulled. Preferably a further handle 19a is provided to the bottom of the front of the device to allow the transport device to be lifted over small obstacles such as steps.

Figure 3b shows an alternative embodiment of the device's transport components which comprises two caster wheels 18a located at the front corners, and two large wheels 18b, 18c (not shown) at the rear. This configuration provides increased the stability over embodiments with a single caster wheel embodiment (Figure 1 a). The device 10 may again be moved when the operator tilts the device so that it rests only on wheels 18b, 18c (not shown).

A housing 1 1 is provided on the wheels 18 which will contain the valuable articles (e.g. banknotes) in use and is therefore preferably armoured. Defined within the housing 11 are a plurality of secure compartments 12 which are separate from one another (i.e. the housing has internal walls separating each compartment 12 from the other compartments). In this example there are four secure compartments 12a, 12b, 12c and 12d, as is particularly preferred since this enables the device 10 to carry up to 4 ATM cassettes (one in each compartment 12) at any one time. Since over 80% of ATMs use 4 cassettes this enables an ATM to be replenished in one trip between the secure vehicle and the ATM premises. However in other examples the device 10 could be provided with a different number of compartments 12, i.e. at least two but more preferably at least three and still preferably at least four.

Each secure compartment 12a ... 12d is closed by an access door 13a ... 13d, which preferably are all arranged on the same side wall of the housing 1 1 , as in the example shown. In this case the housing 11 is substantially rectangular, having four side walls 1 1 a, 1 1 b, 1 1c and 1 1d, a top wall 1 1 e and a base wall 11 f. Here, the four access doors 13a ... 13d are all provided in the front side wall 1 1 a although could be located in another of the side walls. Each access door 13a ... 13d provides access from the exterior of the transport device to its respective secure compartment 12a ... 12d only. Each access door 13a ... 13d is secured by a lock represented schematically at 14a ... 14d. Preferably these are electronically-controlled locks as will be described further below. Each of the secure compartments 12a ... 12d is preferably configured to accommodate a single ATM cassette of any known type (e.g. brand). ATM cassettes are generally rectangular and hence the secure compartments 12a ... 12d are preferably also rectangular to ensure that the ATM cassettes are held securely whilst in transit. Since the different types of ATM cassette may vary in size, inserts (not shown) may be provided to enable the internal size of the secure compartments to be reduced so as to better fit to the ATM cassette. For example, internal walls of each compartment may be provided with grooves into which plates can be slotted in order to provide a reduced-size region to hold the ATM cassette. Desirably the rectangular secure compartments 12 are arranged with their long, narrow face substantially horizontal (i.e. lying in the x-y plane) as shown. This is preferred since the ATM cassettes will then be transported in the same position, with the result that the stacked banknotes therein will be positioned on the edge face of the stack, which is believed to help reduce later occurrences of jamming in the ATM machine.

The transport device 10 could optionally have an additional master door (not shown) covering all four of the access doors with an additional lock, for added security. The master door would then need to be unlocked and opened before any of the access doors 13 could be opened.

Figure 4 shows one of the secure compartments 12 separately from the rest of the transport device 10, for clarity. The Figure additionally depicts components of the protection system and control system. The protection system comprises at least one monitor 16 and at least one degradation module 17, which are preferably managed by a controller 20 which typically also performs other functions as described below. The at least one monitor 16 may be located inside the secure chamber 12 and/or may be distributed at one or more other locations around the transport device 10. The at least one monitor may include any of: one or more sensors for detecting operating parameters (e.g. movement, impacts, vibrations, temperature etc.), one or more electronic means (e.g. circuit monitors, voltage meters, power level meters, antennas) and/or one or more clocks or timers. Depending on the type of monitor(s) provided, certain criteria are pre-defined which are representative of an attack event. For example, detection of motion beyond a pre-set threshold speed or frequency may be deemed indicative of an impact or attempt to cut the housing. Further examples are given below. When criteria indicative of an attack event are detected, the degradation module(s) 17 are activated. This is preferably carried out under the management of the controller 20, which may receive the measurement signals from the at least one monitor 16, process those signals to determine whether any of the pre-determined criteria have been met, and if so to instruct the degradation modules 17 accordingly. Preferably, if an attack even is detected the degradation modules in all of the secure compartments 12 will be activated, although in other examples they could be activated in just one or a selection of the secure compartments (e.g. if a secure compartment 12 is known to be empty, the controller 20 may not activate the degradation module in that compartment).

Examples of monitors 16 which may be provided include:

an accelerometer or vibration detector, e.g. adapted to detect an impact, external force applied to the transport device, dropping or cutting of the transport device;

a penetration mesh disposed across the interior wall of at least one, preferably each, of the storage compartments, comprising electrically conductive filaments, any breakage of which can be detected by an applied circuit;

a moisture or gas detector, e.g. adapted to detect ingress of fluids into the transport device, such as water, salt water, petroleum, diesel, solvents, liquid nitrogen or gas;

a temperature sensor, e.g. adapted to detect heating, burning or freezing of the transport device; a microphone, e.g. adapted to detect vibrational sounds;

an antenna, e.g. adapted to detect radio frequency jamming signals;

voltage and/or current sensors, e.g. adapted to detect the power level of an onboard power source and/or tampering or disconnection of the power source;

circuit monitoring equipment configured to detect for example, electromagnetic pulses (EMP), unauthorised access to the circuit or eavesdropping;

a timer, configured to count down a pre-set time period or to activate at a pre-determined time; and/or

a location device, preferably GPS and/or VHF tracking, configured to detect the absolute location of the transport device and/or its location relative to a known point.

a sensor located in one or more wheels to detect if wheel is on floor, so that the controller 20 may determine whether box is being lifted or held in an unexpected orientation. This may be achieved using a weight sensor.

Preferably, the location device described above is able to detect the location of the transport device relative to the secure vehicle 30 and/or its point of origin and/or destination P. More preferably an attack will be detected if the location device detects that a transport device 10 is further than a pre-determined distance threshold from the secure vehicle 30. Most preferably an attack will be detected if the location device detects that the transport device 10 is further than 100m from the secure vehicle 30 and/or its point of origin and/or its destination P.

In a preferred embodiment the transport device 10 may communicate its location data and optionally its identification code 36 wirelessly to an external controller. This controller may be located either within the secure vehicle 30 or in an external device e.g. a computer located within a national control centre. An example of how such wireless communication may be implemented is described in more detail below with reference to Figure 5. The controller may preferably be further configured to positively identify the transport device 10 from its identification code 36 and compare the location of the identified transport device 10 with the location of the secure vehicle 30 which is storing the identification code 36 corresponding to the transport device 10 in its memory. As described above, if the relative positions of the identified transport device 10 and the secure vehicle 30 are greater than a threshold distance an attack on the transport device will be detected. Having detected an attack, the controller may then send a wireless communication to the transport device 10 informing it that an attack is occurring and instructing it that the degradation modules should be triggered.

Such monitors can be used to detect, and thereby activate the protection system in response to, for example any of:

• Activation by external force on the container with conventional tools (Hand tools or Power tools).

• Activation if cut open with an angle grinder.

• Activation if attacked with a power or manual drill.

• Activation by ramming or driving over with a vehicle.

• Activation if attacked with a Sledge Hammer.

· Activation by smart attacks (hacking EMC, Radiation and so on).

• Activation by liquid attacks - e.g. Water / Salt Water / Diesel / Solvents etc.

• Activation by external attacks with shot guns or any ballistic weapon.

• Activation when battery reaches an empty stage while in closed/armed state.

• Activation when battery is fraudulently tampered with if the case is in closed/armed state.

• Activation by heating up or burning of the box.

• Activation by freezing of the box (within temperature parameters).

· Activation on dropping the case from a height e.g. block of flats or height of over 3 metres.

• Activation on technical manipulation using electronics, EMF or micro tools. • Activation on chemical attack - e.g. Liquid Nitrogen or Gas Attack.

• Activation by present timer expiry (cross pavement timer).

• Activation by exceeding geo fencing parameters

• Activation by exceeded operating time.

The degradation modules 17 could also operate in a variety of different ways. In preferred examples each module comprises a means for breaking or piercing the ATM cassette (or other receptacle) inside the secure compartment, e.g. a needle and/or a pyrotechnic (explosive) charge. The banknotes or other articles of value can then be damaged or destroyed, e.g. by spraying or coating with a marking substance such as dye, glue, foam (e.g. eroding or welding foam), polyurethane foam, ink or smart water (or any combination thereof). Hence in this case the degradation module may comprise a reservoir containing the marking substance and a dispensing device such as a spray nozzle. Alternatively and/or in addition the degradation system could be a mechanical device configured to fragment the articles of value, e.g. to cut, shred or matriculate banknotes, optionally followed by coating with a binding substance such as glue. Preferably banknotes will thus be rendered permanently useless and unusable, and most preferably the degradation will be 100% effective for normal UK paper banknotes as well as polymer notes or mixed batches of paper and polymer notes. In some cases the degradation substance (e.g. glue or dye) may be reversible by a process available only to the cash centre, e.g. to allow separation and counting of the notes, but the notes will not be useable after they have been separated. As mentioned above, the locks 14 which secure each access door 13 are preferably electronically controlled and thus may be opened in response to presenting a corresponding electric key (not shown). This may for example communicate with the lock (or with the controller 20, which preferably also controls the lock) via contactless, e.g. near-field, communication, or could be plugged into an appropriate socket provided on the transport device. Desirably, each individual access door lock 14a ... 14d is responsive to two keys: a master key, which is retained within the secure vehicle, and a standard key which is typically held at the ATM premises. All four access door locks are configured to be opened by the same master key, preferably simultaneously, to allow for fast reloading of the transport device when it is safely inside the secure vehicle (described below). However each standard key will open only one of the access door locks 14a ... 14d so that only one secure compartment 12a ... 12d can be opened at a time when the transport device is outside the secure vehicle. Preferably the access door locks 14a ... 14d are interlocked such that each can only be unlocked by its standard key when each of the other access doors are closed and locked. This interlock is managed electronically by the controller 20 which preferably controls each of the locks on the transport device 10.

Figure 5 shows an exemplary controller network which may be used to implement many of the above-described functions. The controller 20 communicates with the one or more monitors 16a, b (which may be distributed around the transport device and/or local to the controlled as in the case of a timer or a GPS module); with the degradation module 17a ... 17d in each secure compartment; and with the access door locks 14a ... 14d. In this example the communication is implemented by a CANbus 22 but any other networking system could be employed. The controller 20 issues instructions to the various components via the CANbus and also receives data from them, e.g. as to the status of each access door lock 14, the state of the degradation modules 17 and measurements from the monitors 16. The controller may record such data in order to log the status of the transport device and assist in diagnosing faults. The logged data may be downloaded from the device or may be wirelessly transmitted via an optional wireless communications module 21 , e.g. operating on a cellular network, radio frequency, GPRS or near field communications such as Bluetooth. Most preferably the wireless communications module operates via more than one wireless network, preferably at different frequencies, to help prevent a successful attack by EM jamming signals. The wireless communications module 21 may additionally or alternatively be used to receive instructions from an external device. For example, a signal may be sent remotely to activate the degradation modules 17, e.g. from a panic button carried by the operator or from a remote national control centre. The network is preferably powered by an on-board power supply such as a battery (not shown). As mentioned above, the protection system may be primed to activate the degradation modules 17 should the power level drop below a certain level or if attempted tampering (e.g. removal) of the power source is detected.

The transport device may also have a local user interface such as a keypad to receive inputs from the operator, and indicators such as lights and/or a LCD to display information, e.g. as to the status of the device. A siren may also be provided and activated by the controller upon attack and/or remote instruction.

The following lists further preferred features of transport devices (also referred to as a "secure ATM trolley") in embodiments of the present invention:

• Capacity from 1 to 5 ATM cassettes (i.e. preferably 5 compartments)

• The Secure ATM Trolley shall be transported from the vehicle to the

location of the customer premises by wheeled or tracked trolley. This trolley may be powered or be manual operation.

· ATM cassettes secured in individual holders

• Sack truck trolley design for optimum handling and maneuverability

• Trolley electronically coded to the vehicle via the following:

o Electronic Micro switches

o Infra-Red Sensors

o RFID sensors

• A crew proofed security container to carry and protect 4 ATM cassettes or tamper evident Bags that are packed with cash.

• Protected across pavement, operation that reliably degrades all packed cash into an unusable state both for human or machine acceptance in case of an attack

• Preventing illegal opening by the crew.

• Each cassette compartment has its own individual secured door.

• It is only permitted that one compartment door at a time can be opened • Each compartment will be capable of carrying different types of ATM cassettes.

• It is possible to carry, protect and degrade cash bags as well as cassettes using the same system.

· When the container activates, it will be difficult and take some

considerable time to remove the degraded bank notes from within the cassettes.

• The degradation system of the container has the option of remote

activation, by the operator activating a panic device located either on the vehicle or worn on their person.

• The degradation system has the ability to be automatically activated by the national control room sending a secure message to detonate the container.

• The container shall automatically activate the degradation system if the distance permitted from the vehicle is breached.

• The degradation option should activate automatically if the container is taken away from the vehicle or "safe zone" such as the ATM location.

• The external surfaces are good for extracting fingerprints for evidence.

• The container is resistant to shocks and falls from minimum 1 m height. · Container is immune to RFID sources (i.e. wireless communication is via a secure protocol).

• Buzzer / Beeper (local communication with user)

• Red / Green LED's (local communication with user)

• Coloured LED's to indicate operation mode e.g. Blue / Yellow ATM use or CIT

• Push Button operation

• Alarm / Activation Sounder (local communication with user)

• LCD Display (local communication with user)

• The container is "self-powered".

· It must not be possible to turn the power off

• Battery life time minimum of 18 months

• Service Interval shall be 1 Year • Battery Minimum power autonomy 72 hours.

• Battery life time of 5 Years.

• If the unit is stolen and not found, after the power reaches a low level the system will activate the degradation. This is the backstop position.

· M2M communication (Machine to Machine)

• RFID or Near Field Communication

• Health status / firmware updates by air

• Possible to download the electronic logs from the container.

• The electronic logs to contain information about how the container is attacked in the event of a robbery, and will also diagnose any fault or false activation.

• The container sensors (monitors) are capable of detecting any forced opening attempts covering a wide range of attack methods.

• Loud clear recognizable siren which activates on attack or can be remotely activated to locate the container

• The container is clearly identifiable by several copies of serial number which is to remain intact in the event of an attack for identification purposes

• The Banknotes will be rendered useless and unusable.

· Neutralization process will be 100% effective for normal UK paper banknotes as well as Polymer notes or mixed batches of paper and polymer notes.

• Degradation glue / dye is reversible by a controlled process but the notes will not be useable after they have been separated.

· Degradation system incorporates any of the following systems to penetrate the ATM cassette case:

o Needles

o Pyrotechnics

• Degradation system incorporates any of the following systems to render the Banknotes unusable

o Dye

o Glue

o Polyurethane Foam o Ink

o Mechanical cutting and matriculation of the banknote and subsequent bonding

o Use of chemical foam to erode and bond / weld to the banknotes · The opening of the container is secured by an electronic device with a unique identification / authentication code

• The container records the last 500 electronic logs (i.e. "real time clock", date, activation method opening / closing, which keys were used to open, etc).

· The container incorporates a GPS tracking system that is able to send location information and receive a detonate box signal from the Control Room which activates the degradation system.

• The tracking system is integrated with the Box protection system and will transmit the box status report to the Control Room.

· Sack truck design is optimum for handling and manoeuvrability

• Turns on its own footprint

• Centre of Gravity over large wheels when in motion/use

• Small front caster in centre

• Triangular trolley footprint to improve in-vehicle packaging

· Coded to vehicle at arm interface

• Auto-stowed when detected

• Each compartment presented in a position that suits both in-vehicle refilling and ATM bunker operations (side loading, no awkward lift of cassette) Figure 6 shows an alternative embodiment of a transport device 10 with an alternative arrangement of secure compartments 12. The common features between this embodiment of the transport device and the one previously described above are provided with the same reference signs. This embodiment of the transport device 10 may comprise any or all of the preferred or desirable features described above in reference to Figures 3 to 5, and vice versa.

The transport device 10 shown in Figure 6 has five secure compartments configured to hold an ATM cassette, each having a separate access door 13a ... 13e. Hence this embodiment of the transport device 10 is able to carry up to 5 ATM cassettes. Additionally, the transport device has a further secure compartment, with an access door 65, able to hold articles such as the customer site keys for the delivery destination P and/or an ATM unit's "purge bag", such as a bag of items rejected by the ATM (e.g. faulty or stolen credit/debit cards, damaged or counterfeit bills). Each of these compartments may be provided with the features described above in reference to the compartments 12a ... 12d of the alternative embodiment. Each of these compartments 13 may be provided with locking mechanisms 14, monitoring devices 16, degradation modules 17 and any other feature described above in reference to Figures 3 to 5.

Figure 6 also shows a preferred embodiment of a transport device's 10 mount plate. This mount plate may include a number of alignment guides 62. These alignment guides 62 are grooves or holes in the mount plate 61 that accommodate either a part or the entirety of the lift arms 34a. The front face of the mount plate 63 may be curved or angled to help direct the lift arms 34a into the alignment guides 62 when the lift arms are engaging or being docked. This curved or angled mount plate front face 63 reduces the accuracy required by an operator when either aligning the lift arms 34a and transport device 10 when engaging the lift arms 34a into the trolley 10 or when docking the transport device 10 onto the lift arms 34a.

The mount plate 61 may have recesses 64 to accommodate the securing bolts of a locking mechanism 39 located in the secure vehicle's 30 lifting arms 34a. These recesses 64 are preferably located in the side walls of the mount plate 61 and/or the side walls of the alignment guides 62, although they may be located elsewhere. Alternatively when the locking mechanism's 39 securing bolts are engaged they may contact the mount plate 61 to create a friction fit, or enter a bracket or other mechanism. Alternatively the mount plate 61 may include a locking mechanism to fix the transport device 10 to the lifting arms 34a as described above.