It is well known that workmen or other safety personnel often need to access a work site to carry out some service. This service might be the repair of equipment or replacement of equipment or other such activity. In order to carry out this service the personnel need to access the area where work is to be carried out. It is also known that many work environments can provide situations which are safety critical. That is to say when the service is carried out the personnel or users carrying out that service may be under threat. This may come from many different sources.

One particular area in which personnel often need to carry out services under safety critical conditions is in the transport industry for example in the rail industry where rail lines, points and other equipment necessary for the correct functioning of a rail network need to be maintained, checked or replaced. The presence of potentially fast moving vehicles close to the work sites offers potentially lethal circumstances under which users need to carry out services. It will be understood that other areas of potential danger include motorway repair and/or repair close to airports.

One method for reducing risk in such a dangerous environment is to provide a physical barrier such as wall

or fence surrounding the dangerous locations and providing personnel with access points, such as doors, which they may open only once correctly authorised.

However in situations where it is impractical to provide a physical barrier to dangerous locations other forms of checks to ensure the safety of employees/personnel have been suggested.

One of these is to restrict access to a work site for personnel unless those personnel have assessed potential risks and taken steps to reduce as much as possible those risks. This may for example include the introduction of look outs to observe potential risks as they occur and the provision of safe locations to which personnel can locate themselves when conditions become dangerous.

Unfortunately a problem with such circumstances is that they are prone to user error so that look outs and safe locations may be incorrectly or inadequately provided.

Also human nature tends to underestimate danger or potential risks may simply be ignored.

It is an aim of embodiments of the present invention to at least partly mitigate the above-referenced problems.

According to a first aspect of the present invention there is provide a method for increasing safety at a work site which a user is required to access to carry out a service, comprising the steps of: said user determining at least one parameter associated with said work site; said user calling a remote station and providing user data to an operator at said remote station;

responsive to said user information, verifying that said user has correctly determined each said at least one parameter; and subsequently providing said user with an access code for permitting said user to carry out said service.

According to a second aspect of the present invention there is provided a call center for processing calls from users requesting a permit to carry out a service at a work site, comprising: an operator terminal, located remote from said work site, arranged to receive a call from a user and for relaying said call to an operator; a database for holding records associated with a plurality of users; processing means for processing user data provided by said user to said operator and input by said operator; wherein a unique access code is provided to said user if user data provided said user satisfies at least one predetermined condition.

According to a third aspect of the present invention there is provided a method for improving safety at a work site comprising the steps of: identifying a service to be carried out at a work site; prior to said service being carried out, assessing at least one parameter associated with the service; providing data associated with said assessment to a review officer; if said assessment satisfies at least one predetermined condition issuing a unique identifier associated with said service; and

notifying a controller of said forthcoming service prior to said service being carried out whereby said controller can vary at least one condition associated with said work site to reduce the risk of injury at said work site when said service is carried out.

Embodiments of the present invention provide the advantage that key safety personnel must correctly assess potential dangers prior to obtaining authorisation to access a work site. If potential dangers are not correctly identified no authorisation will be given so that personnel will not be permitted to access a location in which safety critical conditions occur.

Embodiments of the present invention provide the advantage that personnel who are responsible for assessing dangers on site have the emphasis placed upon them to do their job correctly and assess potential problems. Users quickly realise that if they are not able to assess problems correctly they will not be able to do their job this acts as a good learning incentive.

Embodiments of the present invention provide a highly efficient system whereby the nature of the system is such that both users at a work site and operators at remote stations can do their allocated tasks with a minimum amount of interaction from the other party.

Embodiments of the present invention provide the advantage that the possibility of a user being in a dangerous location without correctly obtaining authorisation is obviated. This is because users are prevented from accessing potentially dangerous site without first obtaining a valid permit.

Embodiments of the present invention provide a method and apparatus for validating a safe system of work. During a planning stage prior to work being carried out at a target work site a duly authorised user, being a user being trained to make such decisions, is asked to indicate a level of working at the work site which satisfies the highest possible safe system of work available at that site. The user is provided with a hierarchical list beginning with the highest level of safety and if that level of safety is not possible reasons must be selected from an exhaustive list of acceptable reasons. In this way a safe system of work carried out at the target work site is validated and a fully auditable trail of work carried out is recorded.

Embodiments of the present invention provide the advantage that a great deal of planning which occurs prior to and at the time that work is carried out at a work site is automated. This helps prevent errors made by human users, helps speed up the planning and operating process, provides a fully recorded trail to enable users subsequent to work being carried out to identify potential problems and/or prevents vast quantities of paper being required to be stored.

Embodiments of the present invention will now be described hereinafter by way of example only with reference to the accompanying drawings in which: Figure 1 illustrates a work site; Figure 2 illustrates how a call may be made and how a job may be planned;

Figure 3 illustrates an overall system for achieving a safe system of work; Figures 4A to 4E illustrates an automated planning stage; Figure 5A to 5H illustrates a call logging process for issuing a safety check number; Figure 6 illustrates a call logging screen; Figures 7A and 7B illustrate a card validating sequence; Figures 8A and 8B illustrate a web page showing a portion of an electronic sectional appendix; and Figure 9 illustrates the steps taken by a user accessing a target location; and Figure 10 illustrates a remote call centre.

In the drawings like reference numerals refer to like parts.

Various acronyms are referred to hereinbelow. A brief description of some of these is given at this point to aid the reader in their understanding of the present invention.

ATWS refers to an automatic track warning system which is mobile equipment fitted on a railway network and which provides an audible warning to users when a train approaches.

TOWS is a train operated warning system which is permanent equipment fitted at a specific location on the railway network and which provides an audible warning when a train approaches.

COSS refers to a controller of site safety. When a group consisting of more than one person accesses a portion of a railway network at least one of those people in the group must be qualified to provide a system of safe working. Such a person is referred to as being COSS qualified as will be understood by those skilled in the art. Typically a COSS qualified user will be the person responsible for assessing potential dangers and parameters such as line speeds distances and proximity to other dangers of a work site wherever it is located.

SMTH refers to a signal maintenance testing handbook. A user qualified as a signal maintenance tester (SMT) will refer to a testing handbook when carrying out a check of equipment. A check list in the handbook will be used.

Such a person will be referred to as SMTH qualified.

IWA refers to an individual walking alone.

S019 (also referred to as SL19 or Rimini) is an improved standard for use on rail networks which places the emphasis on contractors to pre-plan work which is to be carried out on a rail network. Such work is typically referred to as red zone work or green zone work. Red zone work is work which is considered to be dangerous such as work operating between moving trains. In red zone areas the risk of injury is greater than in green zones. A green zone refers to a location where there is a blockage such a traffic lights preventing potentially

dangerous vehicles, such as trains, from entering that zone. The object of the S019 standard is for contractors to plan to increase the percentage of green zone work in comparison to red zone work.

ATWS is an automatic train warning system which may be arranged at a part of a rail track where work is to be carried out to give an audible and/or visible warning which a train approaches. TOWS is a train operated warning system which likewise provides a warning to work men at a work site when a train approaches. LOWS is a lookout operated warning system which utilises lookouts to give a signal when a train approaches. A PEE WEE is another type of warning system which can be operated at a work site to give a warning when a particular danger is imminent.

Figure 1 illustrates a work site 10 where personnel 11 may be located to carry out some service such as the renewal, mending or replacement of broken equipment. In the example shown the personnel 11 are located near a portion of a rail network which comprises rails and sleepers as will be known by those skilled in the art.

It will be understood that embodiments of the present invention may be utilised in any environment where personnel must access a site to carry out a service and that site may provide a potentially dangerous environment or where access is otherwise to be restricted. In the particular example described hereinbelow workmen at the work site may be allocated specific jobs. For example the workmen may be allocated the task of acting as lookouts in particular directions to try to spot fast moving vehicles whilst further workmen may be allocated

the task of carrying out the actual service such as repairing a rail or sleeper.

There have been various standards which have been developed to which key personnel must adhere when carrying out operations in dangerous circumstances.

Prior to allowing personnel onto the work site a member of the team which will be deployed to carry out the service undertakes to carry out an assessment of the work site and the inherent dangers. In order to do this the assessment personnel will be sent on various courses to teach them what the potential dangers are and how to assess parameters about a work site. In order to help the assessor assess the parameters of a work site a paper form may be provided which will help focus that persons mind as to each and every parameter which needs to be assessed. Once this form (referred to as a COSS 3181 form) has been filled in the assessor telephones a remote station to obtain a permit which will enable that assessor and any other members of his team to access the work site.

Figure 2 illustrates the remote access system. The assessor user uses a mobile terminal 20 to call a remote station 21. The remote station and mobile terminal are connected via a wireless communication link 22 base transceiver station 23 and a router illustrated as the internet 24. Likewise a planner intending to plan work ahead of it being carried out may do so using a user terminal 25. It will be understood that embodiments of the present invention are not restricted to use of such a system for connecting the remote station with a user.

For example the caller may call the remote station directly via a fixed land line.

Figure 3 illustrates an overview of how work (or some other service) may be carried out at a work site (or other target location). It will be understood that such work may be maintenance or fault repair work on a railway line but is not limited to such use. Rather the method and apparatus are applicable to any environment where pre-planned work or work immediately due because of a newly noticed fault must be carried out under a safe system of work. Other possible uses are therefore use on an underground rail network or on a road or motorway network or any other application where human users must access a potentially dangerous environment (such as soldiers accessing a firing range) amongst other things.

Figure 3 illustrates the system employed for providing a safe system of work when work to be carried out may be predicted greater than twenty four hours prior to the work being carried out. This may often be the case for cyclic renewal or cyclic maintenance types of work. When work must be carried out under a safe system of work with less than twenty four hours notice a slightly different procedure will be operated without a preplanning stage as will be described hereinbelow.

Figure 3 illustrates how work is planned and carried out at a rail network work site. As noted above embodiments of the present invention are not limited to such use. At step S301 a supervisor or other manager determines that work must be carried out at a target location. This will require access to rail track. Details of the work to be carried out are passed to a user notionally called a "planner"who, at step S302, works through the details of work and for each incidence of work which must be carried

out the planner seeks to obtain authorisation for carrying out that work. This is achieved by the planner submitting a request together with details of the work to be carried out to a net based planning node 303. This planning process is described more fully with respect to figure 4. If the safe system of work planned by the planner requires an alteration or prevention of trains running on a portion of track the request must be submitted to a body authorised to carry out such alteration or prevention. This is illustrated as step S304. The authorised body which in the area of rail networks may be Network Rail in the UK will either approve or decline a request. This is illustrated as step S305 and this is notified to a post planning portion of the planning node 303. This process is carried out automatically with various users being able to observe the development of the planning process by virtue of a "bulletin board"which is a computer generated display visible to various authorised users either in a planning room 306 or via web pages 307 and 308. The planner, after submitting the request for work to be carried out, will be notified by a web based page bulletin board 307 whether his request has been accepted. If so a unique identifier number, which may be identified as a Rimini number associated with that job is allocated to the particular work job planned by the planner. The planner then moves on to plan for a further job. If the request is denied as notified to the planner via bulletin board 307 the planner must re-plan changing a parameter of the job such as day or time and resubmit a request. Jobs which are accepted are displayed on a further web based bulletin board 308 which is accessible to users who are to carry out the actual work. As a day approaches when a particular job is to be carried out a duly authorised

person such as a COSS or IWA downloads details of the work to be carried out at step S309.

The controller of site safety will then proceed to the work site where further details of a safe system of work to be provided at that work site will be assessed. At step S310 details of the system of work assessed by the qualified user at the work site are verified and if those details satisfy predetermined conditions a unique check number, which may be referred to as a safety check number (SCN), are allocated to the qualified person. This authorises/permits the user and any workmen associated with that user to proceed to carry out work and access a work site. Alternatively the user themselves may not enter the work site.

Figure 4 illustrates in more detail how a planner at step S302 must assess various parameters associated with a job which is to be carried out at a target location. At step S401 the nature of the work itself is identified. This may be part of a cyclic maintenance programme or maybe some other work which has been identified. At step S402 basic planning considerations are accounted for such as resources required i. e. manpower and equipment and a type of protection required. The type of protection may be governed by a rule book associated with the particular industry in which the planning is taking place. For example section T of the rule book setting out how work can be carried out on the rail network in the UK allocates a Ti or Tii type of work which is work which requires the passage of trains on a particular line to be stopped.

In this sense a"job"is defined as work which can be carried out under a single safe system of work (SSoW) which can be verified and for which a safety check number can be issued. These jobs are to be input as described below into a planning system which is designed to prevent inputters selecting a lower method of protection without justifying their decision. If required fields are not completed in the submission the system refuses to submit the request. At step S403 further parameters associated with the job to be carried out are input by the planner into a web based form accessed by the planner. The filling in of these details is carried out by the planner typing in appropriate information into a box identified on a web page or web pages.

Various protection methods are then listed in a specific order. This order starts which the highest protection method which is termed as"safe guarded"and ends which the lowest level of safety possible which is termed red zone with unassisted independent working alone. This process of working must be completed for all jobs and records of the process retained. No hard copies of the process are required but may of course be kept. At step S404 the planner is presented with the safest possible system for working which is a green zone type of working.

The green zone working indicates that human workers are separated from trains. If this option of working is selected at step S405 then the remainder of the planning may be completed and a request for a Rimini number may be submitted to the planning node 303. If this option is not selected at S404 then a drop down menu on the web page accessed by the planner presents a pre-selected list of possible reasons why the option is not necessary or possible. The planner must select one option from this

exhaustive list of acceptable reasons. The reasons for not selecting the most safe system of work are therefore logged and recorded. The selection of a reason for not using the safe guarded system of work is illustrated as step S406.

If a valid reason is selected the next most safe system of work is offered to the planner at step S407. If this option is selected at step S408 then the remainder of the work may be planned and a request submitted for a Rimini number. If the option for the next most safe system of work is not selected a reason must be selected from a displayed list of acceptable reasons. This is shown as step S409.

Option three illustrated in figure 4C is the least safe green zone option possible. If this option is selected at step S410 then the remainder of the job may be planned and a submission made for a planning number (Rimini number) if the option is not selected then again a valid reason must be selected from an exhaustive list of acceptable reasons. The list of acceptable reasons may change for each option but for each option there is a respective list of acceptable reasons. If this option is not selected then the remaining options for a system of work are all termed"red zone"working. Red zone working requires further questions to be asked and answered.

These questions are displayed on the net based web page accessed by the planner when filling out a request. The planner must thus enter further details into pre- displayed boxes. At step S412 an assessment is made as to whether all of these further questions have been answered. If not the request for a Rimini number is aborted. If the planner is successfully able to input

the further required parameters the next most safe system of work is offered. This is the most safe red zone system of working. If this option is selected at step S413 then a submission can be made for a Rimini number.

In this way options for a safe system of work are provided to a planner in a reducing order of safety. If a planner does not wish a more safe system of work to be selected a reason selected from a possible list of options must be chosen and recorded. Occasionally, as indicated by step S414 further questions must be demanded of the planner. These are asked by virtue of the planner having to fill in answers to predetermined questions displayed on a web page. The lowest possible safety for a system of work under which a job can be carried out is indicated by option eight at step S415. This option is selected when no more safe options are possible and then the request for the system of work is submitted.

By virtue of a net based planning system which automatically provides a planner with a pre-selected number of questions and options and which allows the planner to automatically submit the request for a planning number a very efficient system is provided. By defaulting to the most safe system of work and by demanding a planner provide a valid reason for not selecting that system a clear audit trail is provided.

Once a job has been planned the job is stored in a database and displayed on a bulletin board indicating all forthcoming jobs. As a time approaches for the job (an item of work or a service to be carried out) is to be carried out a suitable qualified user who is able to attend the work site will be supplied with the job and

will then visit the work site either alone or with a group of people having the skills to carry out the particular work. As indicated at step S309 of figure 3 the qualified user is provided with details of the job submitted by a planner and visits the work site. As an alternative if work is to be carried out at a work site without preplanning, such as when a fault is apparent on a line or when work has to be carried out with less than twenty four hours notice before the work is identified, this is possible.

Figure 5 illustrates the steps taken immediately prior to carrying out the actual work at a target location and indicates the steps in a call made by an authorised at the work site to an operator at a remote location.

General principles of this system are that all staff working on or about a rail line (a target location) require a safety check number which permits them to access a target location to carry out such work. A safety check number can only be obtained either once a preplanning number, allocated according to the method indicated above, or a fault number are obtained. A fault number is generated when a fault at a target location is reported and a unique identifier, a fault number, identifying that particular fault and other parameters associated with the fault are allocated. It will be understood that embodiments of the present invention are not restricted to use of both the safety check number and planning number. Rather embodiments of the present invention can be used merely to allocate preplanning numbers according to the method described above which may be then used for other purposes. Alternatively the allocation of a safety check number according to the

method described below may also be applied without first obtaining a Rimini number.

At step S501 the duly authorised user who is a member of staff qualified to set up a safe system of work calls a remote location from the work site. An operator answers at step S502 with a request for the caller to confirm that they are located in a safe location. If not they are asked to move to such a location. At step S503 the operator requests whether a Rimini number or fault number are being used to obtain a safety check number. If neither a fault number nor Rimini number are available the call is terminated. An exception to this is when no fault number or Rimini number are available but work must be carried out due to adverse weather conditions. Other exceptional circumstances may be proposed. Under such a circumstance the fault number process S504 is followed.

If a Rimini number is available indicating that the job is one carried out according to a pre-planned schedule that Rimini number which uniquely identifies a particular job and its associated characteristics is requested at step S505. Upon entering the Rimini number various parameters associated with the job indexed by the Rimini number will be entered into a net based screen illustrated by figure 6. These details are auto- populated from the information input by the planner during the preplanning stage. This is illustrated by step S506. When the caller is calling with a fault number rather than a Rimini number a new record is opened which displays the web based page illustrated in figure 6A. This web based page has no auto-populated information but rather all fields will be blank.

At step S507 the operator asks for a Sentinel card number. The Sentinel card is a generally acknowledged identity card which has associated with it a number of parameters for each respective user. It will be understood that for uses other than at a rail track side other types of authorisations may be accepted or the steps associated with the Sentinel card omitted. Each user has a unique Sentinel card number which identifies characteristics such as name and contact details and qualifications for the user. A number of digits from the Sentinel card are entered by the operator at the remote location at step S508 which are input into box 60 in figure 6A. The digits or whole number of the Sentinel card index the various characteristics logged against this card and these are automatically displayed by auto- populating in an upper portion of the work screen 61 viewed by the operator at a location (such as a call centre) remote from the work site.

An assessment of whether the user associated with the Sentinel card number which is provided has valid skills is made at step S509 and if not a Sentinel card validity process is carried out at step S510. These steps are shown in more detail in figure 7. As shown in figure 7 if the Sentinel card number, identified by inputting all digits of the Sentinel card, provided by the caller is not located in a database to which the operator has access the caller is advised that the card is not valid and that the person in question can therefore not carry out the setting up of a safe system of work until the card has been checked. The caller is asked if a further person with the skills which are required is available at the work site. If the answer is affirmative that other person is identified and the system returns to step S509

if another person is not available then an enquiry form is completed and passed to a further authorised user who can access an automated helpline for obtaining and checking validity of cards. If at this stage the Sentinel card can be validated the caller is informed of this fact and the procedure returns to step S509. If not the caller is informed that the card is not valid and that a safety check number can not be allocated. A call is bombed (or terminated) at this point. This informs the caller that they have made an invalid request which means they must reassess the requirements for the site or obtain a further user who is qualified to carry out the system of work required for the site. By terminating the call the emphasis is placed upon the people wishing to carry out work to satisfy requirements. At step S510 indicated in figure 5b emergency contact details for the caller are identified which are filled in at box 62 of figure 6a.

The operator then asks the caller for details of the nature of work at step S510 and these are input in box 63 of the call log screen 64. At step S512 the caller is requested for the location of the work site. The location of the work site is input at box 65 which is provided with a pull down menu. In this way a correct detail location of the work site may be identified. Each specific location indicated in the pull down box is associated with one page from a electronic version of a sectional index setting out details of every possible work site where work or a service may be carried out.

The operator who views the web page illustrated in figure 6 is also provided with a separate user display which forms part of their user interface. The second user display is used to display an image of a section of a

rail network where the work is to be carried out as identified at this stage.

Figure 8 illustrates a page displayed on the further display in front of the operator. As will be appreciated by those skilled in the art the display of the work site and details associated therewith is a highly convenient way for the operator to check whether details provided by the caller are correct and accurate. This acts as double check to assess accuracy and thus aids in improving safety. In this way figure 8 illustrates an image which may be displayed on a terminal in front of an operator subsequent to the input of location information from said user identifying the location of the work site where access is requested. The system for issuing safety check numbers is provided with a database containing details of a large number of locations where work may be carried out. By entering in details of the location and images presented setting out details of lines, speed restrictions, distances between various features and many other different characteristics of the location. The user calling the operator will not have access to this information but the operator will be able to look at the image and ask for details from the user based on the displayed information. Responsive to data supplied by the user the operator establishes whether an accurate assessment of dangers has been made and whether a secure system of work has been put in place. At step S513 the operator assesses whether the work content location and mileage supplied by the caller are correct. If some of the details are not correct a caller may ask a manager for advice at step S514. An assessment is then made whether to continue with the call at step S515 and the

call is terminated at step S516 or returns to the call at step S517.

The next question asked of the caller is whether red or green zone working is to be set up. This is illustrated as step S518. Here if the caller is calling with a Rimini number the system of work is already pre- indicated. However the caller at any time may select a more safe system of work than that used during the planning procedure. However if the caller wishes to go down the planning hierarchy to a lower level of protection then authority must be provided from the callers supervisor or immediate superior. The name and contact details of the person giving permission must be recorded. This provides a clearly recorded record or how work is to carried out at a work site. If red zone working is indicated then the operator will have displayed whether red zone working is permitted at that moment in time or at the time when work is to be carried out at that location. If red zone work is prohibited an assessment of this fact is made at step S519. If red zone working is prohibited the call is terminated as the system is not able to issue a safety check number. If green zone working is selected or red zone working is selected which is not prohibited further details are input at step S520. If the caller cannot answer any of the questions asked at this point satisfactorily the call is terminated. This means that the caller must reassess safety procedures and details associated with the job and call again to be granted a safety check number.

Once the predetermined questions are input at step S510 the system proceeds depending on whether red or green zone working was selected. Figure 5D illustrates the

process when red zone working is to be carried out and indicates how a user is asked for the time needed at a work site at step S522. If this time matches the time indicated by the caller, an assessment indicated by step S523, then line speed is requested from the caller at step S524. If the time calculated at step S522 does not match then a check is made with the caller at steps S525 and 526. If these do not tally then the call is terminated ensuring that details of the call up to that point are recorded. If the line speed is assessed at step S527 to match details illustrated in the sectional appendix displayed as shown in figure 8 the system displays a warning distance required at step S528. If the line speed indicated on the display does not match that given by the caller this fact is checked at steps S529 and 530. If a discrepancy cannot be resolved the call is terminated at step S531. Again details of the call up to that point may be recorded. At step S532 the operator requests that the caller indicates their assessment of the parameter calculated. This parameter may be a warning distance which is required. An assessment is then made whether the two pieces of information match. If not the call is terminated at step S534. If details do match then further questions are asked at steps S535 and S536. These questions require the input of parameters which if not correctly assessed may result in further questions being requested such as those illustrated at step S537. Such a question may result in an alteration to a pre-given parameter such as an additional amount of time being added to a pre- calculated time as illustrated in step S538. An assessment must then be made at step S539 whether the new amended parameter satisfies details given by the caller.

If not then no SCN is provided and the call is

terminated. Details of which are recorded. If the newly calculated parameter matches that given by the caller at step S539 or whether the original parameters match as indicated by step S541 then further questions are asked of the caller at steps S542 and S543 after which the procedure proceeds to the assignment of an SCN as indicated in figure 5H.

Figure 5G illustrates the process when green zone working is selected in figure 5C. The green zone working selection causes a user screen as illustrated in figure 6C to be displayed to the operator at the remote location. The type of protection being set up by the caller is requested by the operator at step S544 and this is selected from the drop down screen 66 according to the type of protection required. Further questions indicated by steps S545 to S547 are requested and these are input into appropriate boxes of the green zone working screen.

When details for red zone or green zone working jobs have been correctly input a further screen is displayed to the operator as illustrated in figure 6D. This is termed the assignment screen. When the assignment screen 67 is displayed at step S548 the operator will request further information from the caller such as whether any further work men, who may be lookouts, hand signal men, site wardens or other skilled workers who are required to carry out parts of a service at a work site, are on site.

Details of these are provided by the caller and entered into appropriate user data input boxes 68 and 69 in step S549. For each named person entered in box 69 and other boxes a Sentinel card ID number associated with that particular user is also entered. These details are entered in box 68. At step S550 an assessment is made by

the operator whether the person associated with the Sentinel card number given by a caller is qualified to carry out the role which the caller indicates that person will be carrying out. If the person is not so qualified the Sentinel card validity process described with respect to figure 7 is carried out at step S551. If the person is qualified to carry out the particular job then the operator requests the next person who is on site and enters their details and checks their skills. This proceeds until all persons due to work at a work site have been duly identified and their qualified skills checked to make sure they are qualified to carry out a particular task which has been allocated to them.

Details of these users are recorded at steps S551 and 552. The caller provides an operator with a time when work is due to commence at a work site and provides an estimate of when the work group will withdraw from the work site. These are entered in appropriate boxes on the displayed screen 67. It is at this point, when the caller has provided accurate information which has been checked by an operator and duly recorded, that an SCN is automatically generated and displayed on the screen to an operator. This number may then be verbally given to the caller at step S553 which then acts to authorise the user and/or the group of people identified by the caller to proceed to access the work site and begin work.

After the safety check number is provided to the COSS caller. The call between the caller and operator is terminated. The job is automatically displayed on a bulletin board in a remote location where authorised personnel may observe the development of that job and other jobs logged by other callers which may be taking place at many different work sites. Since the caller has

provided an estimated withdrawal time of himself and/or his group of workers as time progresses an assessment can be made whether the group is working effectively or whether time will run out. As soon as a job is completed and workers are removed from a target location a qualified caller again calls the operator (step S554) and informs them that the team has withdrawn providing the operator with the SCN number which has previously been allocated to the job. This is illustrated as step S555.

At this stage the bulletin board is updated to indicate that that job has successfully been carried out. However if the estimated time for withdrawal is exceeded (shown as step S556) before a caller calls to indicate that the job has been finished then this fact will be displayed on the bulletin board. The use of colours on the bulletin bard to indicate jobs within time, jobs slightly running late and jobs running well over schedule may be used. At this stage the previous COSS caller is contacted (at step S557) using the emergency contact details received during the prior telephone conversation and is asked if there is any reason why the job is overrunning. The COSS may request a an extension of time. This further call is terminated after a job is finished or an extension of time requested.

Figure 9 illustrates the steps taken when carrying out a service at a work site. Initially the user who is a person in charge of safety and who is COSS qualified completes a form assessing certain parameters at the work site. These parameters might be the location, date of any pre-site visit, where the red zone working is prohibited, whether the job will entail red or green zone working. The COSS qualified user must accurately and correctly assess all information prior to calling the

remote station where a permit to work will be provided.

This is illustrated as step S901 from near to the work site the COSS user uses mobile equipment 20 to call the remote station 21. This is illustrated as step S902. At this stage an operator at the remote station 21 acting as safety verification staff checks information supplied by the COSS user. Details of the conversation and information provided between the COSS user and operator are described above. The call between the COSS user and operator entails the COSS user providing the operator with predetermined information when prompted by the operator. This is illustrated as step S903. Only if the COSS user provides correct information will the operator provide a safety check number. This is step S904. The safety check number acts as a permit authorising the COSS user and his work group to enter onto the work site and carry out the service they need to do under the safety provisions that the COSS qualified user has indicated during the dialogue with the operator. A safety check number is not issued when incorrect data is supplied, in which case the call between the user and operator is terminated immediately, or because such work is not possible. When the COSS user calls the operator they do so in the full knowledge that no assistance will be given regarding possible answers. The COSS user must have calculated and/or established answers to all predicted questions. If a call is terminated that caller, the COSS user, knows that they must reassess the data and call again in order to obtain permission to carry out the work. In this way emphasis is placed on the COSS user to know all the details of the safety provisions and does not rely in any way upon skills and/or knowledge of the operator.

Once a safety check number has been issued, that safety check number (SCN) may be filled in on the paper form pre-filled in by the COSS user. This is illustrated as step S905. The COSS user may then take his work group onto the work site and set up the safe system for work.

Throughout the work an assessment is made by the COSS user to determine if conditions have changed. This is illustrated by step S906. If conditions do change a determination is made at step S907 to see if a new safe system of work can be put in place. If it can the COSS user completes another form and attempts to obtain a further safety check number following the pre-described steps. If no new safe system of work can be put in place or work conditions do not change and the work is completed, work is terminated and the COSS user calls the remote station 21, at step S908 verifying that that particular job has been finished. At the end of a predetermined period such as every day or every week the completed forms are handed in to a supervisor as shown by step S909.

Figure 10 illustrates a remote location such as a call centre 21 in more detail. The call centre includes a processor unit 1000 which may include one or more servers 1001 and associated databases which act as a data store.

A bulletin board 1003 may be linked to the processor 1000 and may display a list of all jobs currently taking place. As noted above these jobs may be highlighted in background colours to indicate when jobs are within a prescheduled time or when they are running late. An operator terminal 1004 includes a user interface including first and second user displays 1005 and 1006 and a keyboard 1007. The multiple screens enable an operator to be provided with a view of a work site and a

web based call logging screen simultaneously. The operator may input data using keyboard 1007 and may be provided with a headset to enable them to talk with a caller whilst typing.

A user will also be requested to provide an estimated time when work at the work site is estimated to be completed. As various jobs are called in from various users and safety check numbers providing those users with permission to access a work site to carry out a service are issued, details of these jobs will be entered in a database at the remote station. A display of ongoing jobs may be displayed on a further user terminal in a call center. The jobs may be listed by either the times when the jobs are called in or in an order associated with the estimated finishing time of the jobs. As the real time progress past or approaches, an estimated finishing time this can be flagged up on the display in some appropriate manner. For example by adding flag icons to the image or by placing the text on a background of different colours. For example green indicating that the timing is ok, amber indicating that the estimated finishing time is close to the real time and red indicating that the estimated finishing time is either very close to the current time or that the job has overrun. In this way a supervisor or further operator may monitor all ongoing work being carried out at relevant work sites and identify possible problems. For example when a job is clearly taking longer than expected, as would be indicated by the current time exceeding the estimated completion time, a call can be made from the remote call center to the mobile terminal of the user associated with that job to check whether there is any problem.

Details such as this may be monitored using web pages linked to the processors of the call center. Details of the web pages which may be displayed to an operator follow on the next few pages.

The above-described system not only provides a system which can reduce risk of accident at a work site but also can be used in conjunction with a method of planning work on a rail network or other environment where work sites need to be set up in dangerous conditions. Projects have been suggested which will reduce the amount of red zone working with respect to the amount of green zone working.

One such project is the Rimini project. The aim of such projects is to place the emphasis on contractors seeking to carry out services at work sites to pre-plan when those works are going to be carried out. In this way steps can be taken to reduce the number of times when users need to access work sites under dangerous conditions. For example by pre-planning arrangements can be made to place blockages such as traffic lights on track or roadways to prevent fast moving vehicles from being in that area. Embodiments of the present invention can be used to enable such pre-planning of work to be carried out.

Embodiments of the present invention provide a method and system therefor by which services to be carried out at work sites can be pre-planned. Each particular job is allocated a unique identifier which may be a number and by pre-planning arrangements may be made with further operators who control parameters of the work site. For example in relation to rail networks certain operators will be responsible for the running of trains whilst

other operators will be responsible for controlling signalling whilst other operators will be responsible for maintaining track. The pre-planning procedures provided by embodiments of the present invention enable an operator who is to maintain a portion of track to pre- plan a job. This may then be submitted to the operators running train and/or the operators controlling signalling in advance of a job being carried out. In this way the flow of trains past a work site may either be terminated or controlled so that a job which may have otherwise been a red zone task is carried out under green zone conditions. Personnel are provided who carry out the tasks of pre-planning work. The planners submit a pre- planned task and these plans are reviewed/validated by a further administrator on screen. If details provided by the planner are acceptable the job is allocated a job number and may be forwarded to the further operators who may be affected by the nature of the task. This may be via a call, fax, e-mail or other means. In this way those operators will be forewarned of a task being carried out in the future and may take steps to modify parameters at that work site. For example by controlling traffic lights in the region, controlling the speed of trains or preventing trains from running.

A bulletin board enables pre-planned jobs to be monitored. This may be in the form of a large display unit which enables personnel to easily observe which jobs have been pre-planned, where, when and other characteristics associated with the job.

As will be understood by those skilled in the art embodiments of the present invention provide advantage over prior art systems in that granting of permission for

users seeking to access a work site to carry out a service is automated. This not only means that information detailing each permission or authorisation granted will be stored, which may be later analysed for detecting trends, but also means that the system is less prone to error.

By placing the emphasis on users for correctly analysing potential risks and other parameters associated with a work site safety can be improved and thereby risk reduced. This is at least partly because a risk assessment officer who will typically be COSS approved can be located close to the work site where an assessment of potential risks is best carried out. An operator at a remote station may however be provided with all sorts of other information that the user at the work site could not practically be provided with. In addition the method and apparatus of the present invention places the emphasis for providing correct information on the work site dangers assessor. This inherently improves the expertise of such a user since they quickly become aware of the fact that without correctly being able to do the job they will not be able to carry out any parts of it.

It will be understood to the skilled reader that the above-described embodiment describes only an example of how the present invention may be carried out. It will be understood that a similar process and apparatus could be used to control access of any user to a location where restricted access is desirable. For example where that location contains valuable goods or contains other inherent dangers such as at an airport or on a roadway.

In this sense embodiments of the present invention provide a method and apparatus which helps maintain

safety and/or security at a target location.

Alternatively embodiments of the present invention improve safety/security over prior art techniques.

It will also be understood that the above embodiments are given by way of example only and that modifications could be made without departing from the scope of the present invention.

Further details of embodiments of the invention follow.

Firstly details of how users may be taught to carry out risk assessment and obtain an SCN. Next details which can be accessed by an operator at the remote station.

Finally details of embodiments used for pre-planning work are shown.