Wireless virtual campus escort system

[0001] This application claims the benefit of U.S. Provisional Application No. 60/507,839 titled “Campus Security System,” filed Oct. 1, 2003.

[0002] The present invention relates to tracking locations and movement of wireless mobile handsets and, more particularly, to systems that monitor progress by a user toward a destination by tracking the user's handset.

[0003] Security personnel are often called upon to escort people between locations on campuses, such as colleges, hospitals and office buildings, because the people are afraid of becoming accidentally lost or injured or they are afraid of being attacked on the way to their respective destinations. This is particularly true at night or if the route to be taken is desolate, passes through an area that is known to be dangerous or is simply unknown. In other contexts, visitors, such as prospective students and service technicians, require escorts, because otherwise the visitors might become lost or enter restricted areas. Although security organizations routinely provide such services, during periods of heavy demand, such as when a library closes, after a concert, after an athletic event or at a shift change, the demands for escorts can far outstrip a security organization's ability to provide them.

[0004] The invention provides methods and apparatus for providing a wireless virtual campus escort to a user while the user proceeds to a destination on the campus. Through a wireless mobile handset, using a web interface or other user interface, the user requests a virtual escort to the destination. The user selects a route, and thereafter a server and/or the handset monitors the user's progress along the route by monitoring the location and movement of the mobile handset and by comparing this information to rules that are based on the selected route, the user's mode of transportation (e.g. walking, bicycling, riding in a car, etc.), current weather conditions, etc. Optionally, the handset is connected to environmental and/or biometric sensors, and these sensors are monitored for indications of danger or injury to the user. The rules are constructed to detect situations that indicate that the user is lost, in danger, in fear, being attacked, ill or otherwise not making expected progress toward the destination. The rules can embody heuristics. For example, the rules can define permitted and prohibited locations and movements of the user, as well as threshold values for sensor data.

[0005] Optionally or alternatively, systems according to the disclosure track the locations and movements of users who are not necessarily proceeding to specific destinations, but whose movements are restricted or to be monitored. These users are issued handsets and, if necessary, the handsets are physically secured to the users, such that the handsets cannot be removed without authorization. The server and/or the handset monitors the location and movement of the handset and compares this information to rules governing authorized and unauthorized movements or locations. Optionally, the handset records the movements of the user, so this information can be used to later retrace the user's path or identify a location that the user visited.

[0006] If the handset or server detects a rule violation, such as a deviation from the prescribed route, a venture out of an allowed zone or into a restricted zone or another suspicious activity, such as a long pause in the progress toward the destination or extraordinary sensor data, the handset or server attempts to contact the user through the handset to ascertain the user's wellbeing or to warn the user. If the user does not respond to the contact attempt and return to the prescribed route, or the user indicates that a problem exists, the server declares an emergency and notifies a dispatcher. For example, the system can display information about the user and the situation (such as the user's location, intended route, restriction, nature of the deviation, sensor data, etc.) to the dispatcher, so the dispatcher can evaluate the situation. If warranted, the dispatcher can dispatch safety or security personnel to the user's location. Optionally, the server can automatically evaluate the situation and dispatch the safety or security personnel.

[0007] The handset sends information to the campus security management system regarding the current location of the handset. This location information can be obtained from any available source, such as a global positioning system (GPS) or similar navigation satellite receiver in the handset, wireless carrier telephone network location information (such as information based on which cell site(s) receive signals from the handset, time of arrival and/or angle of arrival of these signals) and/or location information gathered from communications between the handset and a WLAN(s) in the vicinity of the handset.

[0008] This location information can be augmented or refined with additional information. For example, GPS information can be corrected with information from the Wide Area Augmentation System (WAAS). Because satellite signals, such as WAAS signals, can be obstructed by tall buildings and thus are not always available in “urban canyons” and other locations, these signals can be received by roof-top receivers and rebroadcast to make them available to all handsets capable of receiving the rebroadcast. This rebroadcasting can be via radio signal, over the WLAN(s) and/or other wireless channels.

[0009] The source(s) of location information and correction information varies, as does the availability of wireless communication services, depending on the location of the handset, atmospheric conditions, etc. For example, wireless telephone, GPS and WAAS signals are more likely to be available when the handset is outdoors than when the handset is indoors, however WLAN signals are more likely to be available inside buildings than outdoors. Thus, handsets according to the present disclosure adapt, depending on which wireless service(s) is(are) available, and use the best available communication channel(s) and source(s) of location information.

[0019] The contents of U.S. Provisional Application No. 60/507,839 titled “Campus Security System,” filed Oct. 1, 2003 are incorporated by reference herein.

[0020] The invention provides methods and apparatus for providing secondary notifications to third parties of potential emergencies detected by wireless handsets. FIG. 1 is a block diagram of an exemplary system, according to the present disclosure. One or more wireless handsets, such as mobile telephones, wireless telecommunication systems for the deaf, wireless PDAs, two-way pagers or wireless portable computers, are served by one or more wireless networks. For example, an exemplary handset 100 is served by one or more wireless telephone networks (represented by cell tower 102).

[0021] The handset 100 and/or the wireless telephone network 102 can include a facility to ascertain the location of the handset. For example, the wireless telephone system 102 can include a network-assisted navigation server 104 to provide location information about the handset 100. The network-assisted navigation server 104 can use any of several well-known systems to ascertain the location of the handset 100. For example, the network-assisted navigation server 106 can use differences among times that signals from the handset 100 arrive at various cell towers to ascertain the location of the handset 100. Such a system is commonly known as “time difference of arrival.” Another well-known network-assisted navigation system is called “angle of arrival.”

[0022] Optionally or alternatively, the handset 100 includes a global positioning system (GPS) receiver (not shown) to receive signals from navigation satellites, such as satellite 106. Optionally, the network-assisted navigation server 104 is connected to a satellite receiver 108 for receiving differential correction and navigation data from satellites, such as satellites 104 and 110. The network-assisted navigation server 104 uses differential correction and navigation data from the receiver 108 to correct location information provided by the GPS receiver in the handset 100 and/or to provide the correction information to the handset to enable the GPS receiver to ascertain the location of the handset more quickly.

[0023] If the handset 100 places an emergency call, the wireless telephone network 102 routes the call as dialed, such as to a public safety answering point (PSAP) 112. A user of the handset 100 can place the emergency call for any of a variety of reasons, including an actual emergency, such as an attack, threat, accident or health problem; a perceived emergency, including a sensation, communication, health concern, warning or other message or indication; or a perceived increased risk, including a sensation, indication or absence of an expected event, sensation, indication or communication.

[0024] If the call is placed to a PSAP 112, the wireless telephone network 102 provides the location of the handset to the PSAP in a well-known manner. An operator at the PSAP 112 evaluates the call and, if appropriate, dispatches one or more first responders. As noted, the precision of the location information provided by the wireless telephone network 102 varies, and the location information lacks vertical datum information. Thus, in prior art systems, the operator may be required to elicit additional location information from the caller.

[0025] In systems according to the present disclosure, the handset 100 or the wireless telephone network 102 is configured to detect an indication of a potential emergency, such as an attempt to place an emergency call (or to send an emergency message) by the handset and to use a secondary channel to notify a campus security management system of the emergency indication (collectively hereinafter “call”). As used herein, “campus” refers to any predefined area, such as a college campus, amusement park, shopping mall or corporate campus. The area can be exclusively associated with the campus, such as an autonomous college campus. Alternatively, the campus can be co-extensive with unassociated areas. For example, a corporate campus can occupy portions of one or more floors of an office building, which also houses other, unassociated corporations.

[0026] An emergency call can be identified by its destination. For example, an emergency telephone call placed in the US or Canada generally has a dialed number of 911. Other countries or regions also have characteristic emergency dialed numbers, such as 999 (England), 112 (most of Europe) or 110 or 119 (Japan). Similarly, an emergency message, such as a short message service text message or an e-mail message, can be identified by its destination address, such as [email protected] or [email protected].

[0027] Emergency calls are not, however, limited to voice calls and text messages. As used herein, “emergency call” includes all forms of communication that are attempted by the handset 100 in case of an emergency. Furthermore, other methods can be used to identify an emergency call. For example, a speech recognition system can be used to monitor a voice call for certain words that indicate an emergency situation. Text messages can be similarly monitored.

[0028] An application program in the handset 100 can detect emergency call attempts made by the handset by observing the destinations of call attempts by the handset and comparing these destinations to a list of one or more predetermined destinations. These predetermined destinations can include the emergency dialed numbers, text message destinations and e-mail destinations, as described above, as well as other destinations, such as a telephone number of a college campus security organization. The list of predetermined destinations can be entered via the handset's keypad or it can be downloaded from a central server.

[0029] The handset 100 can also detect emergency call attempts by other mechanisms, such as by detecting an activation of a “panic button” on the handset or a panic button activation on a wearable device 121 (discussed in more detail below), which is communicated to the handset by the wearable device. Other mechanisms for detecting emergency call attempts are described elsewhere. Furthermore, the handset 100 can be configured to detect emergencies and automatically attempt to place emergency calls and/or to notify a third party, as described below.

[0030] FIG. 2 is a block diagram of a mobile telephone handset 100. The handset includes a keypad 200, by which a user can place a call or send a message. A cellular voice interface 202 modulates and receives radio frequency (RF) signals, enabling the handset 100 to place and receive voice calls over the carrier's wireless telephone network 102. A cellular data interface 204 modulates and receives RF signals, enabling the handset 100 to send and receive data via a high-speed data channel, as is commonly available through wireless protocols, such as the CDMA family of protocols and the GSM family of protocols.

[0031] Optionally, the handset 100 includes a satellite receiver 206 to receive location data from a navigation satellite. Although the present disclosure refers to the GPS satellite navigation system, other satellite or terrestrial navigation systems are acceptable. Examples of acceptable navigation systems include the Global Orbiting Navigation Satellite System (GLONASS), GALILEO and the Quasi-Zenith Satellite System (QZSS). In addition, the handset 100 can include a “software configured navigation receiver,” which can be configured to receive signals from these and other sources of navigation information.

[0032] The handset 100 can also include a Wi-Fi interface 208 for connecting to available Wi-Fi “hot spots,” a Bluetooth interface 210, a WLAN interface 212 and/or other wireless interfaces (not shown). Optionally, the handset 100 can include one or more sensors 214, as discussed in more detail below. These and other components of the handset 100 are interconnected by a bus 216.

[0033] A central processing unit (CPU) 218 executes software stored in a memory 220 to control operation of the handset 100. The software includes an operating system and an application program that performs the functions described herein.

[0034] Returning to FIG. 1, when the application program being executed by the CPU 218 of the handset 100 detects an emergency or an attempt to place an emergency call, the application program uses a secondary channel to send one or more messages to one or more preprogrammed destinations, such as a campus security management server 114, independent of the channel used to place the emergency call. The application program can detect the emergency call attempt by monitoring key presses on the keypad 200 or by acquiring call status information through telephony software running on the handset. Alternatively, the application program can register with the operating system of the handset 100 for notification of call attempts.

[0035] The messages sent by the handset 100 to the campus security management server 114 convey information about the handset, the user of the handset, the emergency, the attempted emergency call and/or other information, as described below. The handset 100 can use a (second) voice channel to send the messages. Alternatively, the handset 100 can send the messages over a data channel, via a wireless telephone network voice and data server 116, such as one maintained by the same telecommunications carrier that provides the wireless telephone system 102 or another carrier. Such a server 116 forwards the messages via a wide area network (WAN), such as the Internet 118, to the campus security management server 114. One or more of a carrier's data services or text messaging services, such as the short message service, can be used to carry the messages. Alternatively, the handset 100 can send the messages via a Wi-Fi connection (not shown), as is well-known in the art.

[0036] Alternatively, the handset 100 can send the messages via a campus wireless local area network (WLAN) 119, a Bluetooth connection (not shown) or any other wireless channel that is available to the handset. For example, the WLAN 119 can be an 802.11 b or 802.11 g wireless Ethernet network, and the handset 100 can be equipped with an appropriate wireless network transceiver.

[0037] If the handset 100 cannot directly access the wireless telephone system 102 or the WLAN 119, the handset can send the messages indirectly, via one or more other suitably configured handsets, such as handset 120. Communication between the handsets 100 and 120 can be via Bluetooth or other suitable wireless connection. This other handset(s) 120 relays the messages to the wireless telephone system 102 or the WLAN 119, such as by the mechanisms described above or by placing a call to the campus security management server 114 or a modem indirectly connected to the server.

[0038] Optionally, sensors can be used in conjunction with the handset 100 to detect physical conditions in the vicinity of the handset. Data from the sensors can be used to automatically trigger an emergency call attempt and/or data from the sensors can be sent to the campus security management server 114. For example, an ambient temperature sensor can be used to detect fire, and a heart rate monitor can be used to monitor the health of the user of the handset 100. Threshold values, such as upper and lower temperatures, can be stored in the handset 100, either by downloading these values or entering them through the keypad 200. If a sensor value reaches its threshold, the application program being executed by the CPU 218 of the handset 100 can automatically place an emergency call and/or send a notification message to the campus security management server 114.

[0039] Some or all of the sensors can be included in the handset 100 (as described with reference to FIG. 2), in one or more units that are connected by wired or wireless links to the handset or a combination thereof. A wearable device 121 can include one or more biometric sensors and can be linked to the handset 100, such as via a Bluetooth or optical link. Biometric sensors can sense heart rate, blood pressure, body temperature, respiration rate, oxygen saturation, galvanic skin response, etc. Environmental sensors can sense temperature, smoke, oxygen level, noise, acceleration, toxins, radioactivity, etc.

[0040] Systems according to the present disclosure enable the location of the handset 100 to be ascertained with more precision than in conventional emergency call systems. Some systems use information received from WAAS to correct GPS data. The time required for a WAAS-enabled GPS receiver to achieve a first accurate position fix varies depending upon whether the GPS receiver contains current GPS and WAAS almanacs. These almanacs list the GPS and WAAS satellites. Modern WAAS-enabled GPS receivers have provisions to store a copy of the WAAS and GPS satellite almanacs. Typically, a standalone GPS receiver is initially loaded with a copy of the GPS almanac at the time of manufacture. However, the GPS almanac can become obsolete, due to changes in the constellation of GPS satellites. The WAAS almanac is usually not loaded at the time of manufacture, because the particular copy required depends on the location in which the receiver is ultimately used. To decrease the amount of time taken by a WAAS-enabled GPS receiver in a handset to ascertain the location of the handset, systems according to the present disclosure distribute the GPS and WAAS almanacs to handsets over higher bandwidth channels than are available directly from the satellites, as described below.

[0041] As with GPS signals, WAAS performance varies depending on the location and physical environment of a WAAS receiver. Because WAAS relay satellites (currently Inmarsat AOR-E & AOR-W) are in equatorial orbits, it is not always possible to receive signals from the satellites, such as when mountains, trees or large structures obstruct the view of the southern sky below certain azimuth angles. WAAS signals are not, for example, always available in urban areas bounded by tall buildings (“urban canyons”). However, WAAS correction data does not vary rapidly in time or across a region. Thus, WAAS data that is valid for a region can be shared with local handsets that are unable to receive their own WAAS signals directly from a satellite. Since institutional campuses are generally not free of obstructions, systems according to the present disclosure centrally receive and then rebroadcast WAAS data to handsets and provide this data to servers, such as the campus security management server 114.

[0042] A satellite receiver 122 for differential corrections and navigation data is connected to a receiving antenna 124 located on a rooftop, tower or other location with good reception from the satellites 106 and 110. The satellite antenna 124 and receiver 122 provides the correction and navigation data to the campus security management server 114 and, optionally, other campus security management servers (not shown). For example, other campus management servers within 75 air miles can be served by one antenna and receiver. The location of the antenna 124 is precisely known and is used as a reference for all local GPS or WAAS-enable GPS receivers in handsets used on the campus or in surrounding areas. Thus, the receiver can serve as a local area augmentation system (LAAS) for the handset 100.

[0043] Information from a WAAS satellite can be used to correct errors due to ionospheric delays, carrier frequency deviations, satellite wobble and the like. However, tropospheric delay characteristics vary by region and with time. A system of some fifty sampling stations distributed across the US collects data on tropospheric delays, averages this data and provides the average to the WAAS satellites for broadcast. Thus, correction data for tropospheric delays that is provided by the WAAS satellites is not specific to any particular region. However, region-specific tropospheric delay correction data is available from a number of sources, including the Continuously Operating Reference Station (CORS) system, the Internet-based Global Differential GPS (IGDG) system, FAA beacons operating at Category 3 airports and various private sources.

[0044] The campus security management server 114 uses WAAS correction data from the WAAS satellites 110 and/or from local CORS, IGDG or other sources. In addition, the campus security management server 114 receives region-specific tropospheric delay correction data from one or more of the sources mentioned above and/or the server calculates its own tropospheric delay corrections. The campus security management server 114 combines the region-specific tropospheric delay correction data with the other WAAS correction data and rebroadcasts this information to the handset 100, enabling the handset to more accurately ascertain its location. This rebroadcasting can be via the WLAN 119, via the Internet 118 and the wireless telephone network voice and data server 116 or via a Bluetooth connection (not shown) or a radio frequency (RF) rebroadcaster 126. The power of the rebroadcaster 126 and its antennas are configured and located so the rebroadcast signal reaches what would otherwise be dead spots on the campus.

[0045] The campus security management server 114 queries the satellite receiver 122 and collects and assembles reference data about each GPS satellite that is in view of the antenna 124. The campus security management server 114 obtains the WAAS and GPS almanacs that are appropriate for the WAAS and GPS grids in which the handset is located, and the server downloads these almanacs to the handset 100. The campus security management server 114 also collects WAAS correction data for all in-view GPS satellites and assembles and distributes a local WAAS correction data table for the in-view GPS satellites, as described above. Assembling and distributing WAAS correction data for only in-view GPS satellites minimizes the size of the messages transmitted to each handset. Furthermore, providing WAAS and GPS data sets and almanacs to the handsets enables the GPS receivers in the handsets to operate in the more rapid starting modes described below. In some cases, the GPS receivers must receive these datasets before they can begin operating.

[0046] Handsets on a campus are considered local to their respective campus security management server 114, which means that each handset supported by the campus security management server 114 uses identical in-view WAAS and GPS satellites. The campus security management server 114 multicasts in-view satellite data and correction messages. These multicast messages can be sent as a UDP data stream via the data channel established by the handset 100 over the carrier network 102, via the WLAN 119, Bluetooth (not shown) or other wireless channel. Sending this data as multicast messages minimizes the requirement for the campus security management server 114 to provide real-time message responses to individual requests from handsets for essentially identical data. Only handsets that require this information join the multicast group(s) and receive the messages. Using multicast connections reduces the number of messages exchanged between the campus security management server 114 and the handset 100.

[0047] The campus security management server 114 employs different multicast groups to transmit updates at different intervals. Each handset 100 chooses to join one or more multicast groups, depending on the update rate required. This allows the handset 100 to elect to receive less frequent updates and reduce cost when infrequent updates are adequate to maintain precision and to elect more frequent updates when needed to maintain acceptable accuracy. For example, the handset 100 can choose to receive updates every five minutes under normal (i.e. non-emergency) circumstances and to receive updates every two seconds during an emergency (such as between the time an emergency call is attempted and the time the emergency ends).

[0048] The campus security management server 114 collects WAAS correction data with sufficient frequency to ensure that the latest data used by the server and distributed to the handset 100 deviate little from actual correction factors. Most correction factors change very slowly, so these updates need not occur frequently. However, if the campus security management server 114 detects a change in the correction data that would cause a change in location accuracy greater than about one-half meter, the server distributes a fresh update of the correction data. This parameter can, of course, be made adjustable. Otherwise, the periodic WAAS update rate is based on the needs of the active handsets. In one embodiment, absent the above-mentioned change in the correction data, the campus security management server 114 provides a WAAS update to the multicast stream once per minute.

[0049] If a handset 100 or the campus security management server 114 determines that the handset's position data is poor due to inadequate or low quality GPS data, a request is made for updated correction data or for an increased WAAS update rate. For example, the handset 100 can send a request to increase the WAAS update rate. Each such request results in cutting the update interval in half by providing updates halfway between existing periodic updates, using the next multicast group. A system configuration option sets the baseline and the minimum update interval. In one embodiment, the interval between updates is at least 15 seconds.

[0050] The campus security management server 114 transmits the correction data streams over all available channels, such as the WLAN 119, the rebroadcaster 126, Bluetooth and the Internet 118/wireless telephone network voice and data server 116. This allows the handset software to choose which data stream is most likely to provide the information that the handset needs in the least amount of time and/or at the lowest cost. If the handset 100 cannot receive the correction data from the campus security management server 114 via any channel, the handset reverts to receiving this information from the WAAS satellite 110.

[0051] One or more redundant campus security management servers and/or satellite receivers (not shown) can serve as backup stations for the campus security management server 114 and the satellite receiver 122, respectively. Similarly, the campus security management server 114 and/or the satellite receiver 122 can serve handsets (not shown) on other campuses, even if the other campuses are not in identical WAAS correction grid locations.

[0052] Alternatively, the campus security management server 114 receives uncorrected GPS data from the handset 100, and it receives correction data from the satellite receiver 122. When the handset 100 sends raw (uncorrected) GPS pseudorange data, the handset flags the data as being uncorrected and the handset identifies the GPS satellite(s) associated with the sent data. The campus security management server 114 calculates corrected location information from the raw GPS data and the correction data from the satellite receiver 122. Optionally, the campus security management server 114 provides this corrected location information back to the handset 100.

[0053] Although the present disclosure refers to WAAS location correction information, other sources of navigation correction information, such as the ground-based European Geostationary Navigation Overlay Service (EGNOS) are acceptable.

[0054] Optionally or in addition, the campus security management server 114 ascertains the location of the handset 100 using information from the WLAN 119. For example, if the handset 100 detects that the number of available in-view GPS satellites has fallen below a number necessary to provide reliable location information, the handset uses WLAN-based location information, in addition to any available GPS data, to locate the handset. A geographical information system (GIS) database 132 contains information about the topology of the WLAN 119, locations of wireless access points in the WLAN and geographic regions covered by each of these access points. Such a GIS database can be created by surveying the campus, measuring signal strengths and generating test transmissions through the wireless access points.

[0055] Information about which wireless access point(s) in the WLAN 119 receives signals from the handset 100 and information from the GIS database 132 are used to ascertain the location of the handset. For example, if several wireless access points simultaneously receive signals from the handset 100, the handset is located within an intersection of the regions covered by the receiving access points. Other information from the WLAN 119 can be used to more finely resolve the location of the handset 100. For example, identifications of access point(s) receiving signals from the handset 100, strengths of the signals received by the wireless access point(s) and relative arrival times at the access points of these signals can be useful in this regard.

[0056] Optionally, routers that actively participate in the location process can be used. When a location request message is detected, the routers silence non-emergency traffic to reduce latency of the location messages. The handset 100 then sends messages encoded with sequence numbers, which the routers relay to each other to determine a relative time of flight. When the wireless access points are initially installed, distances among their antennas, and possibly cable lengths to the routers, are accurately determined, so the propagation times between them are known accurately. The routers can then synchronize their clocks, based on this known propagation time. Using synchronized routers permits time-stamping a message from the handset 100 by each router, thereby enabling calculation of a differential propagation time.

[0057] An optional database 130 stores information about the handset 100 and the user of the handset. For example, the database 130 can store contact information for the handset 100, such as the handset's telephone number, IP address and/or MAC address. If dynamic IP addresses are used, this information is updated in the database 130, when appropriate. The database 130 can also store information about capabilities and options settings of the handset 100 and a log of interactions or incidents involving the handset. Some handsets exhibit different capabilities or interactions when the handsets are docked to base stations. The database 130 can include information about these variations and information about the current state of the handset 100.

[0058] The database 130 can also store the user's name, physical description, photograph, affiliation with the campus (e.g. student, faculty, staff or visitor), medical history, medical condition, drug allergies, home address and telephone number, campus address and telephone number, doctor's contact information, a person to contact in case of emergency and other information that the user chose to disclose.

[0059] Messages from the handset 100 include an identifier of the sending handset or an identity of the user. This information is used to locate the user's record in the database 130. For example, the database 130 can contain records that associate handset identifiers with users. When the campus security management server 114 displays information about an emergency call attempt, the server can automatically display some or all of the information in the database 130 about the handset 100 and the user. Alternatively, the campus security management server 114 displays information from the database 130 in response to requests from the dispatcher.

[0060] As noted, when the handset 100 detects an emergency or an attempt to place an emergency call, the handset sends messages to one or more predetermined destinations. These messages can be sent sequentially or in parallel. The destination(s) can be selected based on information available at the time of the emergency or call attempt or on information that subsequently becomes available, either locally or as a result of communications sent to the handset. Thus, some destinations can be notified of the emergency somewhat later than the original detection. Local information (on which the destination selection is based) can include data from the sensors. Local information can also include results from computation, including algorithms that process the sensor data or that detect indications or derive indications, such as timeouts, errors, absences of desired responses, inappropriate responses, actions or inactions by the user of the handset 100. Communications to the handset 100 can be from a target of a prior communication or attempted communication, a solicited response from another site or an unsolicited message, such as a warning message.

[0061] When the campus security management server 114 (or another such server (not shown)) receives a message from the handset 100 indicating that the user or the handset attempted to place an emergency call, the server obtains location information about the handset. Depending on the wireless network, the handset's capabilities and other factors, the location information can be corrected or uncorrected location information. In addition, the (uncorrected) location information that the handset provided (or would have provided) to the PSAP 112 is also sent by the handset to the campus security management server 114.

[0062] The campus security management server 114 displays information about the emergency on a dispatcher workstation 128. An exemplary display is shown in FIG. 3. The displayed information can include a map 300 of the campus. Information about the handset and its user can be displayed as icons superimposed on the map 300 to represent the corrected location 302 and the location 304 that was provided to the PSAP. Uncertainty in the locations can also be represented by outlines 306 and 308. Information about the user, the handset and data from the sensors can be displayed as text 310. In addition, an image 312 of the user can be displayed. An operator monitoring the dispatcher workstation 122 (FIG. 1) can dispatch campus safety or security personnel to the site of the emergency. Furthermore, the operator can place a call to the PSAP 112 and provide additional information about the emergency, such as its vertical position. Alternatively, the operator can be prepared to receive a call from the PSAP 112 soliciting additional information about the emergency.

[0063] The secondary notification to the campus security management server 114 includes information about the originally-attempted emergency call, such as the destination number or address, the time of the attempt, whether the attempt was successful, whether the contact is still active or when the call ended or how the call ended (for example, loss of signal, ended by the caller or the telephone network, ended by the PSAP 112 or due to incomplete data). If the attempted emergency call failed, this secondary notification provides a means of notifying a secondary service, such as a campus security management organization, that the call was attempted, as well as providing the secondary service with all the intended contact information, so the secondary service can attempt to establish communication, directly or indirectly, with the originally-intended contact.

[0064] The campus security management server 114 correlates multiple emergency calls using spatial and temporal similarity in order to report and display them as a group. This format makes it possible to easily filter duplicate reports and use multiple reports to assist in localizing the emergency.

[0065] Systems according to the present disclosure have the ability to use some or all of the available location data, including WAAS, GPS and WLAN-based data, to achieve the most precise possible automated determination of the location of a handset. The simplest method or combination of methods is used to compute an accurate position in the shortest possible time. Degraded modes are also supported, including using GPS alone (when a WAAS signal is not accessible), providing available GPS data (when the number of in-view GPS satellites is not sufficient or the satellites are incorrectly positioned for an accurate location determination) and using WLAN data (when GPS data is unavailable or inadequate). As noted, all location information, even corrected location information, has some inherent uncertainty. Information provided to the dispatcher via the dispatcher workstation 128 reflects the extent of this uncertainty, which, when overlaid on a map, assists the dispatchers and responders in determining an optimal search approach.

[0066] If a handset 100 detects a degradation or loss of its local WAAS correction signal from the satellites 110 and from the campus security management server 114, the handset begins to utilize the last known WAAS correction data according to one of multiple strategies. Each strategy relies on historic data and includes computations based on the approximate location of the handset, current solar cycle, time of day, time of year and the local history of the rate of change of the WAAS correction signals. The handset 100 can compute estimated future values of the WAAS correction data, based on the historical data and the local rate of change. The handset 100 uses the last known signal data to calculate these estimated future values and, thereby, to compute an estimated time at which the last valid WAAS data will result in a location fix error that would be greater than a position fix error using only in-view GPS satellites. If the handset does not receive WAAS correction data directly from a satellite at the expiration of this time, the handset sends a network request (pull) message to the campus security management server 114 to request updated GPS and WAAS correction data from the server. If the handset software detects a change in the handset receiver location that could potentially invalidate or negate the usefulness of the aged WAAS data, the handset ceases to use the correction data and computes position fixes using only information from in-view GPS satellites.

[0067] If the handset 100 detects an increase in geometric dilution of precision (GDOP) error (due to the loss of a sufficient number of widely-separated in-view GPS satellites), the handset increases the frequency of its requests to the campus security management server 114 to obtain updated WAAS correction data, especially satellite clock updates. The frequency of these requests is further increased if the handset 100 detects that both the rate and amount of change in each updated location fix exceed predetermined thresholds, i.e. the handset detects changes in GDOP location faster or slower than the threshold. The initial threshold is set by the travel mode (e.g. walking, bicycling, riding in a vehicle, etc.) of the user. The rate of updates required is computed using one or more factors, which can include the capability of the handset 100, the user's recent travel history, a log of navigation satellite data, the user's current location, the current and predicted signal coverage, destination, and other current environment factors.

[0068] Use of GPS satellites to determine position has become widespread. However, a GPS position determination has inaccuracies due to errors that cannot be corrected by a simple GPS receiver. These errors are unique to each satellite and can also vary over time and by location of the receiver.

[0069] The Federal Aviation Administration (FAA) developed and deployed a WAAS to provide continuous differential correction signals to WAAS-enabled GPS receivers, which significantly improves the accuracy and reliability of simple GPS position estimates for both aviation and non-aviation uses. WAAS signals are available throughout most of the continental US and use the same frequencies as GPS satellites, which allows a standard GPS receiver to detect and process the WAAS signals.

[0070] WAAS satellites send augmentation messages with clock corrections, ephemeris corrections and ionospheric corrections. Tropospheric error corrections cannot be made using WAAS, due to the localized nature of this error, so the tropospheric error data is removed from the data stream provided by the WAAS satellites. This allows a WAAS-enabled GPS receiver to apply its own tropospheric error correction, based on an atmospheric model based on the current location of the receiver.

[0071] A WAAS-enabled receiver processes WAAS augmentation messages as factors of position calculations. The GPS-like signal from a WAAS satellite can also be used by a WAAS-enabled GPS receiver as an additional source for calculating the receiver's position. The WAAS messages contain information that allows WAAS-enabled GPS receivers to correct errors in GPS signals, thereby providing a significant increase in location accuracy and reliability. The specified accuracy of WAAS is stated at 7.6 meters vertical and horizontal, however WAAS often provides accuracy of one to two meters horizontally and two to three meters vertically. Error data compiled by the National Satellite Test Bed (NSTB) division of the FAA has documented an average error of less than two meters horizontally and vertically over a three-month interval.

[0072] WAAS messages indicate which components of GPS are unusable due to satellite or other system errors or other effects. For example, WAAS sends a notification of a GPS satellite error within six minutes of the error.

[0073] As noted, modern WAAS-enabled GPS receivers have provisions to store a copy of WAAS and GPS satellite almanacs. The time required for a GPS receiver to achieve a first accurate position fix varies depending upon the starting mode of the GPS receiver. There are three possible starting modes.

[0074] If a GPS receiver has no valid copy of the GPS almanac, the receiver enters a “cold start” mode. The GPS almanac is a 15,000-bit block of coarse ephemeris and time model data for the entire GPS constellation of satellites. Without an almanac, the GPS receiver must conduct a very wide frequency search to acquire a satellite signal. Very often, signal acquisition takes several minutes to complete, because a large number of frequency cells must be searched. If the entire GPS constellation is searched, the procedure can take more than 12 minutes, because each GPS satellite transmits at only 50 bits per second (bps).

[0075] If the GPS receiver has a stored copy of a valid GPS almanac, the receiver enters a “warm start” mode, which greatly reduces the number of frequency cells that must be searched. The bulk of the time required to generate a position fix is the time required to acquire a 900-bit satellite data message (SDM) from each in-view GPS satellite. The SDMs are used to compute the GPS receiver's position. The SDMs are broadcast every 30 seconds at 50 bps. Assuming parallel operation of several GPS receiver channels, the average time required to obtain the SDMs from all the in-view satellites is approximately 30 seconds.

[0076] If the GPS receiver has a current, valid SDM from each in-view GPS satellite (a total of 7,200 bits for eight satellites), the receiver enters “hot start” mode. In this mode, the GPS receiver must receive range information from the satellite, which is not included in the SDMs. The time required to generate a position fix equals the time required to acquire a signal from each in-view satellite, plus the time required to generate a pseudorange measurement for each satellite. The total time is usually less than one second.

[0077] Loading the WAAS almanac can occur independently of loading the GPS almanac. Most GPS receivers include several channels, over which they can simultaneously receive signals from respective satellites. A GPS receiver can receive signals from a WAAS satellite over any of these channels. In any of the above-described modes, a WAAS-enabled GPS receiver can receive WAAS signals over one channel and receive GPS signals over other channels. Thus, the GPS receiver can load the WAAS almanac in parallel with receiving GPS satellite signals. Reception of a complete WAAS almanac from a satellite takes approximately five minutes.

[0078] Some national carriers currently employ assisted GPS (A-GPS) to provide higher accuracy position fix information to PSAPs. A hybrid A-GPS is used in regions where GPS reception is poor or unreliable. The hybrid A-GPS uses cell tower location information to augment A-GPS location information.

[0079] During an emergency call, carriers that support A-GPS correction data on their networks expect to interact with handsets according to a specific network protocol. One type of system uses the cellular network to provide A-GPS data messages to the handset, which then returns time-stamped, raw pseudorange measurements to the network, and a network element computes the handset location. Another type of system provides detailed GPS constellation data and timing signal hints to the handset, which then computes its location and reports its location back to the network. While this high-level protocol can vary from carrier to carrier, the contents of the A-GPS data messages that are sent by the network to the handset are similar from carrier to carrier. The handset responses are also similar from carrier to carrier.

[0080] Because a handset can receive WAAS data from satellites, the handset can compute a more accurate location fix than by using only A-GPS information. However, large differences in location fix accuracies can occur if a carrier network GPS support server (such as the network-assisted navigation server 104 shown in FIG. 1) uses an atmospheric delay model that is not appropriate for the current location of the handset. Location fix errors are largely attributable to errors caused by inappropriate compensations for ionospheric delays. Additionally, the carrier network GPS support server typically does not have local tropospheric delay correction data for the current location of the handset. The carrier network GPS support server usually zeros out this component of the computation. Other delays are caused by latency in the carrier network, which may delay delivery of current satellite clock updates between the carrier network GPS support server and the handset.

[0081] As noted, existing systems for providing handset location information to PSAPs have significant shortcomings. For example, existing systems do not provide vertical position fix data from the handset. Current emergency communications protocols do not provide a means of reporting vertical position information. WAAS-enabled GPS receivers can ascertain their vertical location, often to within two to three meters. Such vertical position data can be very helpful in critical situations, such as when a caller is located within a multistory building. For example, using the callers vertical location, the caller's location could be isolated to within one or two floors. However, this vertical location information cannot be provided to PSAPs using existing systems. Furthermore, there is no guarantee that position correction data provided by a carrier's network is appropriate for the WAAS grid location of the handset.

[0082] FIG. 4 is a flowchart illustrating operation of the application program stored in the memory 220, and executed by the CPU 218, of the handset 100. At 400, the handset detects an emergency call attempt. At 402, the handset ascertains its location. This can include using correction data provided by the campus security management server 114 to correct a GPS data received by the handset 100. Alternatively, as noted, the handset 100 can provide uncorrected GPS data to the campus security management server 114. At 404, the handset sends the location information, an identifier of the handset, the emergency number dialed and other information about emergency. The handset 100 sends this information over the best available link. For example, if the campus WLAN 119 is available, the handset uses this channel.

[0083] At 406, the handset 100 sends subsequent messages with updated status information about the emergency. The handset 100 can send these update messages periodically, in response to queries from the campus security management server 114 and/or upon a change in the status of the handset. For example, if the sensor indicates a changed value or the emergency call is ended, the handset 100 sends an update message.

[0084] At 408, if the emergency is not ended, control passes back to 406. Otherwise, at 410, the handset 100 sends a message to the campus security management server 114 to indicate the emergency is ended.

[0085] FIG. 5 is a flowchart illustrating operation of the campus security management server 114. At 500, the server 114 receives a notification message from the handset 100 indicating an attempt to place an emergency call. The message identifies the handset 100 and/or the user. At 502, the campus security management server 114 uses the identification information provided by the handset 100 to fetch information about the handset and the user from the database 130. If the handset 100 provided raw location information (rather than corrected location information), at 504 the campus security management server 114 corrects the raw location information using correction information provided by the satellite receiver 122. At 506, the campus security management server 114 displays information about the incident on the dispatcher workstation 128. The dispatcher can interact with the campus security management server 114 via the workstation 128 to request additional information or reformat the display.

[0086] At 508, the campus security management server 114 periodically requests updated status information from the handset 100. Responses from the handset 100 to these requests provide updated location information about the handset, as well as updated sensor data. Thus, the dispatcher can monitor the emergency situation in real time. The frequency of these update requests can depend on the nature of the emergency. For example, if sensor data indicates a medical emergency, these updates can be as frequent as once per second. Alternatively, the dispatcher can specify the update frequency through the dispatcher workstation 128. At 510, if the emergency ends, the operation ends, otherwise control returns to 508.

[0087] For purposes of illustration, an aspect of the invention has been described in the context of providing notification (to a campus security management server) of an emergency 911 telephone call. However, the invention is applicable to any automatic location or automatic notification system. As noted, a system according to the invention can notify a central site in response to detecting an attempt to place an emergency calls, send a message, or other user action. An attempt to place an emergency call is not, however, necessary. Similarly, the system can notify the central site in response to an automatically detected situation (i.e. without a user action), such as a sensor detecting an excessive heart rate, radiation or an extreme temperature in the vicinity of the user. The system can, but need not, automatically place a call to an emergency service or other location. For purposes of this application, attempting to place an emergency call includes an explicit user attempt to place such a call or send a message or an automatic attempt to place a call or send a message (such as a result of detecting extraordinary sensor data or deviation from a planned route) by a handset or by a device communicably coupled to the handset.

[0088] Although the campus security management server 114 is shown as a single component, the server can comprise a number of interconnected servers, such as database servers, web servers, communication servers, mapping servers, navigation servers and the like. Similarly, although only one dispatcher workstation 128 is shown, systems according to the disclosure can include plural dispatcher workstations. Not all these workstations need to include identical interfaces and perform identical functions.

[0089] The invention provides methods and apparatus for providing a wireless virtual campus escort to a user while the user proceeds from a starting point to a destination on the campus. The user interacts with the campus security management server 114 to request an escort and to select a route to the destination. The campus security management server 114 proposes one or more routes based, for example, on the user's current location, the desired destination, information stored in the GIS database 132 (such as locations of exiting walkways, roadways and lighting fixtures), current time of day, season, weather and expected arrival time. Optionally or alternatively, systems according to the disclosure track the locations and movements of users who are not necessarily proceeding to specific destinations, but whose movements are to be restricted or monitored.

[0090] As noted with respect to FIGS. 1 and 2, the handset 100 can include a GPS receiver or other facility, by which an application program executing within the handset can ascertain the location of the handset. Optionally, the application program also monitors sensors that are in the handset or that are communicably coupled to the handset. Alternatively, software executing within the campus security management server 114 ascertains the location of the handset and receives data from the sensors.

[0091] After the user selects a route, or restrictions are placed on the user, the campus security management server 114 uploads rules to the handset 100, and a software application executing in the handset thereafter monitors the location and movement of the handset and compares this information to the rules. The rules are constructed to detect actions, inactions and data from the sensors that are likely to indicate that an escorted user is in danger or a restricted user has or is about to perform an authorized action. For example, if an escorted user suddenly accelerates to a speed that is inconsistent with the user's mode of travel (for example, a walking user accelerates to a fifty miles per hour, indicating the user entered a vehicle), suddenly reverses direction, pauses (ceases making progress toward the destination) for more than a predetermined length of time or deviates from a prescribed route by more than a predetermined amount, or if a sensor indicates that a user sustained a strong blow, one or more of the rules “fire” and cause the system to treat the situation as a potential emergency (also referred to as an “alarm”). Similarly, one or more rules fire if a restricted user enters a restricted zone or comes within a predetermined distance of a restricted zone, or the restricted user leaves an authorized zone. If a rule fires, the handset solicits wellbeing status from the user or warns the user. If the user does not respond or return to the prescribed route or authorized zone, the handset 100 sends a message to the campus security management server 114.

[0092] In another embodiment, software executing in the campus security management server 114 monitors the location and movement of the handset and, in case of a deviation from a rule, attempts to contact the user through the handset.

[0093] If the campus security management server 114 is notified of, or detects, a potential emergency or unauthorized action, the server displays information about the user and the situation on the dispatcher workstation 128. As noted with respect to FIG. 3, the dispatcher workstation 128 can superimpose this information on a map of the campus. Optionally, the campus security management server 114 fetches additional information about the user from the user information database 130 and displays this information on the dispatcher workstation 128.

[0094] Optionally, sensors can be used in conjunction with the handset 100 to detect physical conditions in the vicinity of the handset. Data from the sensors can be used to automatically trigger an alarm and/or data from the sensors can be sent to the campus security management server 114. Some or all of the sensors can be included in the handset 100 (as described with reference to FIG. 2), in one or more units that are connected by wired or wireless links to the handset or a combination thereof. The connectable units can be carried by the user or they can be a fixed part of the campus infrastructure. For example, classroom buildings can be equipped with temperature, smoke and toxin sensors that can communicate via Bluetooth with any handset within range of the sensor. A wearable device 121 can include one or more biometric sensors and can be linked to the handset 100, such as via a Bluetooth or optical link. For example, the wearable device 121 can be in the form of a bracelet, necklace, wrist watch, lapel pin or other device. Optionally, the wearable device 121 can be inconspicuously carried by the user, such as in a pocket. The wearable device 121 can be inconspicuously sewn into the user's clothes.

[0095] Some sensors provide binary (yes/no) values, such as push buttons or smoke detectors. Other sensors provide continuous values, such as thermometers. (Digitized values are considered to be in a continuous range.) Yet other sensors process signals before providing them. For example, a speech recognizer processes utterances and provides a text transcription of the utterances. In another example, a voice stress analyzer analyzes sounds and provides an indication of the amount of stress the speaker is under.

[0096] Software handlers for the sensors can be loaded in the handset 100. These handlers include values, comparisons and actions. For example, a handler for a temperature sensor can include upper and lower threshold values. If the comparison yields a “true” result, the handler performs the specified action. For example, the upper threshold is compared with the temperature sensor's output, and if the temperature sensor's output is greater than the upper threshold, the handler signals an alarm.

[0097] Once attached to the user, some wearable devices can be detached only by a member of the security organization. For example, a bracelet can be attached to the user's wrist and locked in place. Such a bracelet cannot be easily removed without an appropriate key. Optionally, the wearable device includes sensors that detect attempts to surreptitiously remove the wearable device and notify the handset or the campus security management server 114 via any available wireless channel, including via other wireless devices. A user who is being attacked can trigger the alarm by removing or unclasping the wearable device without necessarily raising an attacker's suspicion. Such a wearable device would also trigger an alarm if an attacker removes the wearable device, such as jewelry or a chain, from the user.

[0098] Alternatively, the wearable device can be configured such that it can be removed without triggering an alarm only when the device is close to, and communicably coupled to, the handset and the handset is located at a predetermined location within the campus, such as a visitor center or security office. The wearable device can ascertain its location through the location-determining mechanism described above or by requiring that the handset be placed into a docking station or by providing alternative communications equipment at the facility that detects that the wearable device is present. The wearable device can communicate with the handset 100 using any available wireless channel, such as Bluetooth. Optionally, if the wearable device is separated from the handset 100, as detected by a loss of the wireless channel, the handset can raise an alarm. Upon loosing communication with the handset, the wearable device can enter a “beacon mode,” as described in more detail below.

[0099] The campus security management server 114 can collect real-time data, such as snow accumulation, from properly equipped campus infrastructure. For example, a plow vehicle or operator can be equipped with a handset, and a sensor (communicably coupled to the handset) on the plow vehicle can detect whether the plow blade is in an upper or a lower position as the plow vehicle traverses walkways and roads. Based on the frequency with which the plow vehicle crosses a given point on the campus, the position of the blade when the vehicle crosses the point and the snowfall rate (which is generally available over the Internet from sources of weather information), the campus security management server 114 can estimate the amount of snow accumulated at the point. The snow accumulation amounts can be used to score various route segments during route selection and planning.

[0100] Due to conditions that are difficult to measure, such as drifting snow, the snow accumulation data should expire after a predetermined or calculated amount of time, similar to the way information about temporary obstructions expires. When available, the snowfall rate is factored into the aging to cause the snow accumulation data to expire sooner if the snowfall rate is high or the wind speed is high.

[0101] Rules can define a combination of sensor states that can be taken together to provide an indication of an actual emergency with more confidence than is available from the sensors individually. For example, a combination of an impact, a subsequent decrease in elevation, followed by a lack of motion can indicate a likely serious emergency situation.

[0102] Environmental sensors incorporated in the handset or communicating with the handset can be employed to warn of hazards, to report environmental hazards as part of alarm reports to assist in providing appropriate emergency assistance or to generate alarms independently. Heat/temperature, smoke, oxygen, toxin and radioactivity sensors are a few possible environmental sensors. Such sensors may be located on the campus and used to notify users within a defined radius of a potential hazard.

[0103] One condition is likely to be detected by sensors associated with multiple handsets. The campus security management server 114 correlates data from these multiple handsets in order to map an affected area. When a dangerous condition is detection, such as temperatures that indicate a possible fire, other nearby handsets can be identified and queried for sensor values relating to the condition. Using this data, it is possible to identify the safest routes, such as stairwells free of fire or smoke or the areas where toxins have the lowest concentration. Toxin propagation can be identified by updates over time in order to identify areas of risk. Users can be directed away from those areas, directed toward the safest escape routes and warning messages can be sent to users in the affected area. Additional information about the sensors and wearable device is provided above and below.

[0104] The GIS database 132 includes information that facilitates route planning. The GIS database 132 includes information about destinations and travel route segments. This information can include locations of building entrances, landmarks, meeting places, halls in buildings, outdoor walkways, driveways, open spaces (fields, etc.) and the like. For each of these items, the database can include information about nearby lighting fixtures and areas illuminated thereby (a “lighting map”), foliage, areas covered by surveillance cameras, buildings or other structures that might block satellite signals (a “shadow map”), grade (slope), known unsafe areas (including physical dangers, such as construction, icy walkways and slippery slopes above river banks), estimated travel times during various times of year or under various weather conditions, protection from the elements (such as roofs), hiding places (where perpetrators might hide) and proximity to manned security stations and emergency call boxes.

[0105] Social dangers, such as locations or areas that have been used or frequented by attackers or have been the subject of other crimes, such as burglaries or drug use, are treated separately using a crime map overlay of the campus service area, which is generated and maintained on the campus security management server 114. The crime map is created and updated from crime data collected by security management personnel and can include the type of crime, frequency of occurrence and locations or areas of occurrence. The data is evaluated and weighted by the system to establish the severity of a crime. For example, a bicycle theft would be evaluated as less severe than an assault. The crime map overlay is then used by the campus security management server 114 to evaluate the relative safety of computed or recommended travel routes. For example, if a serious a crime is reported on or near a particular location on a well-used night route that had previously been rated as “safe,” the system presents an option to the system administrator to reclassify the route or area. Example classifications include “not recommended for females,” “unsafe” and “do not use for routing.” The system administrator can also maintain or restore a route or area to “safe” status. For example, after a perpetrator is caught or if a particular occurrence of a crime is considered not to warrant a change in route safety status.

[0106] In addition, information about the precision with which a path can be traveled or a person can be located within a space is helpful. For example, if a foot path is only three feet wide, a person that is positioned more than about three feet from the center of the foot path is likely to no longer be on the foot path and may have been taken off the foot path against his or her will. In contrast, a roadway can be tens of feet wide, so a person who is located within ten feet of the center of the roadway is still likely to be traveling along the roadway. Similarly, a person can be located anywhere within an outline of a quadrangle or a lobby. The GIS database 132 includes dimensions, such as widths, of travel paths.

[0107] The GIS database 132 maintains both current and predicted information about the quality of GPS signal coverage for the campus and along potential route segments. This information is used in selecting routes that have maximum signal coverage along their lengths and avoiding routes that have spotty or non-existent coverage or if the campus security management server 114 predicts GPS coverage will change while a user travels to a destination.

[0108] The GIS database 132 also includes information (a “signal map”) about the quality of signal coverage for both voice and data channels provided by each of various wireless telephone carriers at various locations along potential routes. This information can be useful in selecting routes that have maximum signal coverage along their lengths and avoiding routes that have spotty or nonexistent coverage. One carrier might provide superior coverage along one route and a different carrier might provide superior coverage along a different route. Thus, information identifying a user's wireless telephone carrier is useful in selecting a route that has best coverage by that user's carrier. The user information database 130 includes an identification of each user's carrier. Similarly, information (a “WLAN signal map,” “Bluetooth signal map,” etc.) on the quality of coverage by the WLAN 119, Bluetooth channels, and other wireless networks is useful, as is information on whether the user's handset 100 includes capabilities to communicate with the WLAN, Bluetooth network, etc.

[0109] Initial information regarding GPS and each carrier's signal strength and coverage can be gathered by surveying the campus. Such a survey typically involves taking signal strength measurements at various locations on the campus and correlating these measurements with precise geographic location information about the sample sites. Additional real-time signal information can be obtained, and existing information can be refined, by polling handsets carried by security personnel and users as these people traverse the campus. The campus security management server 114 can poll these handsets for their locations and signal qualities detected by the handsets. Thus, the campus security management server 114 can constantly update both the GPS signal coverage and wireless network signal coverage information for all carriers serving the campus.

[0110] Optionally, one or more broadband cellular receivers (not shown) connected to the campus security management server 114 monitor wireless carrier frequencies to ascertain the operational status of all cell sites that are within range to service the campus. Information about cell site operational status is useful, because these cell sites or individual transmitters can cease operating without warning, thereby making that cell site or transmitter unavailable for exchanging information between the campus security management server 114 and the handset 100.

[0111] Other GIS database 132 information about locations and paths can include times (hours of the day, days of the week, vacation and holiday schedules, etc.) at which the locations and paths are likely to be crowded or desolate. Each item in the GIS database 132 has a rating, so a score for a proposed route can be calculated by summing the ratings of the items along the proposed route.

[0112] A user requests a virtual escort by interacting with the campus security management server 114 or with a human operator at the server. The user interacts with the server 114 via a web interface or via an application program executing in the handset 100. The server 114 can include a web server (not shown) to provide a web interface, and the user can request a virtual escort and select a route through a personal computer (PC) that is connected to the web interface, such as via the Internet. Alternatively, the application program in the handset 100 communicates with the campus security management server 114 over the WLAN 119, via Bluetooth or over the data channel provided by the wireless telephone network carrier 102. If the user interacts with a human operator, the human operator interacts with the campus security management server 114 via a network interface on the user's behalf.

[0113] In either case, the user specifies a destination location to the campus security management server 114 by selecting the destination from a menu or by typing the destination's name or other identifier on the keypad of the handset 100. The menu can be text-based or it can be graphical. The menu can contain fragments of maps of the campus, landmarks, coordinates, etc. A graphical selection mechanism can be displayed on a screen of the handset 100 by the application program executing within the handset.

[0114] Alternatively, the user specifies the destination by physically taking the handset 100 to the destination in advance of the escort request. For example, if the user anticipates requesting a virtual escort back to his or her dormitory or a parked vehicle after a concert, before leaving the dormitory or vehicle, the user can request the campus security management server 114 to ascertain the location of the handset and store this location in the GIS database 132 or in an “address book” in the user information database 130. Optionally, the user enters a name and a description of the location, and this name and description are used for subsequent menu-based beginning or destination selections.

[0115] When requesting an escort, the user's current location (i.e., the location of the beginning of the escort) can be automatically ascertained by the handset or the campus security management server 114, as described above. Alternatively, the user can identify his or her current location by selecting from a menu or typing the current location's name or other identifier on the keypad, as discussed above.

[0116] Once the user specifies the destination to the campus security management server 114, the server proposes at least one route from the user's current location to the destination. The security management server 114 consults the GIS database 132 to ascertain possible routes between the beginning and destination locations. The security management server 114 calculates scores for these possible routes, taking into account factors, such as the current time, estimated arrival time, weather, GPS signal conditions, the user's carrier's signal conditions, likelihood that foliage or other obstructions along the route will prevent satellite navigation or correction signals from reaching the handset 100, transient conditions (such as construction and road closures), major events (such as concerts) scheduled to end during the requested escort and number of other requests for virtual escorts at approximately the same time between proximate starting locations and proximate destinations. Optionally, the security management server 114 also uses real-time data, such as the condition of snow-plowed walkways, when calculating scores for the possible routes. (Collecting real-time data is discussed in more detail below.) Other considerations for selecting potential routes are listed in Table 1.

[0117]

TABLE 1
Considerations for Selecting Potential Routes
Favored Routes May Place the User:
Where others are likely to be present, thus reducing the risk of attack
and increasing the potential for assistance from others, if needed
Near scheduled patrols by security personnel
In areas of strong navigation and communication signals
On covered or plowed walkways in inclement weather
In areas of minimum risk of accidental danger or purposeful harm
In areas having surveillance cameras

[0118] The security management server 114 presents the highest scoring routes, their distances, scores and estimated travel times, and the user selects one of the routes. Optionally, if the user does not select one of the proposed routes, the security management server 114 can present additional routes until the user selects one of the proposed routes.

[0119] Alternatively, the user can choose to specify a custom route, i.e. a route that is not proposed by the campus security management server 114. In this case, the user describes the route to the campus security management server 114 in one of several ways. The user can specify the route by specifying each turn along the route, or the user can travel the route in advance, with his or her wireless handset, and the server 114 or the handset 100 can record the locations of the handset. In yet another embodiment, the user specifies the custom route, intersection-by-intersection. In this case, the campus security management server 114 displays a list of nearby intersections, and the user chooses one of them as the starting point. The campus security management server 114 identifies all intersections that are adjacent to the specified intersection and displays a list. Again, the user chooses one as the next intersection, and the process repeats until the destination is reached.

[0120] These methods can be combined. For example, the user can specify a first portion of a route as a series of turns, and then the user can switch to intersection-by-intersection mode. Alternatively, the user can specify only a beginning part of the route, and leave the remainder of the route selection to later. The user can begin following the route before completing the route specification.

[0121] The user information database 130 stores information about previous routes traveled by the user. If the campus security management server 114 detects that the user frequently selects one or more routes, the server can offer to store these routes as “favorites” in the user information database 130. The campus security management server 114 can offer these routes instead of or in addition to routes calculated as described above. The user can select a favorite or other stored route in its entirety, modify the route or augment the route. In addition, historical actual travel times can be used to refine estimated travel times for route segments that this user previously traveled. If the campus security management server 114 receives information concerning a change in weather or other condition (such as construction) along a route that is currently being followed, the server sends an updated route to the handset 100 and notifies the user, such as with an alarm (ring tone, vibration, etc.).

[0122] FIG. 6 illustrates an example scenario, in which a user requests a virtual escort after dark, along a route 600 from an auditorium 602 to a dormitory 604, starting at a starting point 606 and ending at an ending point 608. The route 600 was selected over other possible routes, because the walkways of the route are illuminated, such as by lights 626 and 628, as indicated in the GIS database 132. A different, shorter, route that includes sidewalk 630 is disfavored, because the sidewalk is not illuminated.

[0123] The campus security management server 114 uploads information about the selected route 600 to the handset 100. This information includes an identification of each turning point along the route 600, so the handset 100 can display this information to the user. Such a display can guide the user, for example with an instruction to “Turn left on Elm Street.”

[0124] The campus security management server 114 also uploads rules for the selected route 600 to the handset 100. The rules define rectangular areas (“travel boxes”) 610, 612, 614, 616, 618 and 620 in which the user is permitted to travel along the prescribed route 600. Each travel box covers one route segment. Multiple travel boxes can exist between turning points if an attribute, such as the width of the allowable region of travel, is wider in one section than in another section, the road or other way is curved or a long, straight region is broken into smaller sections in order to support detection of backtracking within a short time. Once the user leaves one travel box and enters a subsequent travel box, the handset 100 can delete the rules related to the previous travel box, because the user has made relatively constant forward progress from the starting point 606 to the ending point 608. However, to accommodate some backtracking by the user, adjacent travel boxes overlap one another. This overlap also ensures that the route is fully covered and monitored. In addition, the overlap accommodates some error in the ascertained locations of the handset 100. For example, due to location determination errors, in one sample of the handset's location, the location might be calculated to be closer to the starting point 606 than in an earlier location sample, even though the user moved away from the starting point.

[0125] Each travel box 610–620 covers a relatively straight route segment. Where the route 600 turns, such as at intersection 621, separate travel boxes 614 and 616 are used for each relatively straight route segment.

[0126] The rules can also define rectangular areas (“prohibited boxes”) that the user is prohibited from entering. The user may not be permitted to enter a prohibited portion of the campus as a matter of policy. For example, a plumber working on a college campus might be prohibited from entering an electrical substation. Alternatively, the prohibited boxes can be used to identify dangerous areas, where the user is permitted to enter, but entry would be evidence of foul play or accident. For example, if the user fell or was pushed into a pond 622, the campus security management server 114 would appropriately notify the dispatcher. Thus, a prohibited box 624 surrounds the pond 622. Irregularly shaped prohibited areas can be covered by a plurality of overlapping rectangular prohibited boxes.

[0127] The campus security management server 114 also defines one or more rectangular “check-in boxes” along the route that the user is to follow. Each check-in box overlaps the end of a travel box. The check-in boxes are spaced apart, such that the user is expected to travel between each pair of successive check-in boxes in a relatively short period of time, such as 45 seconds. For example, a first check-in box 632 overlaps the end of the first travel box 610. In this example, the check-in box 632 is located less than 45 seconds (at the user's expected rate of travel) from the beginning of the travel box 610, because the user must cross a road 634 before proceeding, the user might have to wait for a pedestrian crossing signal before crossing the road and the estimated travel time along travel box 610, plus the estimated wait time at the pedestrian crossing, is longer than 45 seconds. Locations of the second and subsequent check-in boxes are calculated as the user traverses the route 600, as described below.

[0128] The actual distance between successive check-in boxes depends on the user's mode (and therefore expected speed) of travel. For example, a user walking on a sidewalk is expected to travel slower than a user riding on a bicycle or in a car, but faster than a user riding in a wheelchair. The actual distance between successive check-in boxes also depends on the check-in time interval. The locations of the check-in boxes can be selected such that no two successive check-in boxes are separated by more than (for example) 100 feet nor more than (for example) 45 seconds of travel time.

[0129] The location calculation can use other factors, such as the user's average speed over the recently traveled route segment(s), current weather conditions, terrain over the next route segment, expected quality of wireless network coverage in the next route segment (the signal map), expected visibility of satellites for location determination (the shadow map), and information about the user from the user information database 130, such as historic travel rates. For example, if a location that is otherwise acceptable for a check-in box, but the location has wireless network coverage or satellite reception that is expected to be poor, a location closer to the prior check-in location can be selected. For example, a covered walkway 638 might prevent the handset 100 from receiving GPS satellite signals. If a check-in box would otherwise fall within the covered walkway 638, the check-in box is moved closer to the beginning of the respective travel box. Thus, the second travel box 636 is placed before the covered walkway 638. The campus security management server 114 sends the calculated location (and time, as described below) of the next check-in box 636 to the handset 100.

[0130] Each check-in box has an associated due time window, which includes an expected travel time (such as 45 seconds) from the previous check-in message to the next check-in box, plus an allowance (such as 15 seconds) for the user to pause along the respective route segment and to accommodate variations in travel rate.

[0131] A conditional check-in mechanism can be employed at controlled intersections and other points of potential delays of known duration. If a delay above a threshold value occurs while in a check-in box having such a mechanism enabled, a second check-in is performed upon exit from the check-in box in order to adjust the expect time of arrival at the next check-in box.

[0132] For simplicity, the route 600, the travel boxes 610–620, the check-in boxes (such as check-in boxes 632 and 636) and the prohibited box 624 are all on one plane, however these elements can include an altitude component. For example, a travel box can allow a user to traverse halls or rooms of a multi-story building by specifying the altitude(s) of the floor(s) on which the user is allowed to travel.

[0133] Route planning for visitors is similar, except the routes may not have defined starting points and destinations. Visitors may be allowed to wander anywhere within the travel boxes, and the travel boxes can be large, to accommodate travel anywhere in a building or set of buildings, for example. In addition, the rules may allow a visitor to remain still, and check-in boxes need not be created for visitors.

[0134] Once rules are uploaded to the handset 100 and escorting begins, the handset begins monitoring the location and movement of the handset. The handset 100 maintains two logs in its memory 220. A current travel log is essentially a circular buffer that stores location and other information samples collected over a relatively short period of time, such as one minute. One or more samples can be taken during the time period represented by the current travel log. Each sample's information includes the time and date on which the sample is taken and the speed, height (altitude) and ending location of the handset at the end of the sample. The application program can apply the rules to the information in the current travel log to ascertain if a potential emergency condition exists and, if necessary, to send this information to the campus security management server 114.

[0135] A travel history log contains information similar to the current travel log, except the speed and height information are averaged over time intervals (such as five minutes) and the averages are stored. The travel history log contains information collected since the beginning of the current escort, i.e. since the user began following the current route. This information can be used for evidentiary purposes, such as to prove the user's whereabouts at particular times. To preserve the user's privacy, information in the travel history log is typically not provided to the campus security management server 114, unless an emergency situation exists. Information in a travel history log can be accessed by the user, such as to find the user's way back to a parked car. The application program executing in the handset 100 can, upon command from the user, accessed information in the travel history log and display this information on the screen of the handset.

[0136] The battery compartment of the handset can include a switch to detect if the compartment is opened or the batter is removed. If so, or if the handset 100 is turned off via its power switch, a small backup power source (such as a second battery or a capacitor) can keep the handset operating long enough to send a message to the campus security management server 114 and, thereby, raise an alarm. On a handset that employs a fuel cell, a shutdown procedure is followed before the fuel cell is turned off or removed. Initiating the fuel cell shutdown procedure can cause the handset 100 to send a message to the campus security management server 114.

[0137] The user can manually trigger an alarm by entering a predetermined sequence of keystrokes on the handset 100. The sequence should not already being used by the handset for another function, so the available sequences vary by handset. For example, entering a two-digit code and pressing the “#” key can be programmed as the activation sequence. A different activation sequence can be configured for each user. If the handset is equipped with a speech-recognition capability, spoken words can be used to trigger an alarm. Alternatively, a loud noise can be used to trigger the alarm.

[0138] A handset 100 enters an alarm state because the user manually activated the alarm state, a rule in the handset fired or the campus security management server 114 commanded the handset to enter the alarm state. When an alarm is active, the handset 100 can collect identification information from nearby handsets and/or wearable devices, such as via Bluetooth communication. The handset 100 can report this information to the campus security management server 114 for storage in a log and to subsequently help identify potential witnesses.

[0139] The software application in the handset 100 can be configured such that if the handset enters an alarm state, the handset requests nearby handsets to actively monitor and report information to the campus security management server 114. The nearby handsets provide selected information, such as their locations and audio and/or images captured by the nearby handsets. This information provides the campus security management server 114 with additional opportunities to refine the location of the handset 100 that is in the alarm state. The campus security management server 114 can also gather additional information that may be useful in assessing the threat level and may help to identify the attacker and/or potential witnesses.

[0140] In addition, collecting environmental data from nearby handsets can help effect a rescue or direct a safe rescue or escape by identifying which areas present fewer risks. For example, knowing which of several stairwells has the lowest temperature or highest oxygen concentration could help direct people who are attempting to escape a fire. Similarly, knowing the areas of higher and lower toxin concentration provides data necessary to direct people away from areas of higher concentration.

[0141] If the user permits continuous location monitoring and the handset 100 has computed a location with reasonable accuracy (such as within one meter), the software in the handset can be configured to automatically mute or change the ringing mode of the handset to inaudible mode when the handset is in a classroom, theater or other venue where cell phone disruptions are prohibited.

[0142] The rules loaded into the handset 100 are constructed to detect situations that indicate that the user is lost, in danger, in fear, being attacked, ill or otherwise not making expected progress toward the destination. The rules can embody heuristics. For example, the rules can define permitted and prohibited locations (such as travel boxes 610–620) and movements of the user, as well as threshold values for sensor data. Table 2 lists exemplary rules. If the application program executing in the handset 100 detects the handset's movement (or lack of movement) or data from a sensor violates a rule, the application program notifies the user and inquires as to the user's well-being. The user must, within a predetermined amount of time, return to the prescribed route 600 and reply to the inquiry and indicate he or she does not need assistance. Otherwise, the handset 100 notifies the campus security management server 114, which declares an emergency and notifies a dispatcher via the dispatcher workstation 130.

[0143]

TABLE 2
Exemplary Rules
	Stopping for longer than a predetermined period of time.
	Thresholds periods can vary automatically based on data,
	including weather and GIS data, such as topography of a route
	segment. Longer thresholds may be used for locations adjacent
	crosswalks, elevators and door that requires a code, card or key.
	Sensors may detect the state of crosswalk signals to determine if
	a delay is warranted.
	Sudden change in altitude, especially with a final position
	close to local ground level, may indicate a fall. A greater than
	normal allowance should, however, be made for vertical travel at
	a location known to have an elevator, without raising an alarm.
	A sensor detecting an impact (acceleration), a loud noise,
	an elevated heart rate, a sudden change in galvanic skin response
	or any emergency condition described above.

[0144] To ensure the user makes progress toward the destination point 608, the campus security management server 114 establishes check-in boxes, as noted above, and estimates travel interval times between them. It transmits these locations and intervals to the handset 100 as part of the route information. When the handset 100 detects that it entered a check-in box, the handset notifies the campus security management server 114 by sending a message that includes the handset's location. Upon receiving this notification, the server 114 recalculates the check-in time for the subsequent check-in boxes. For example, after the campus security management server 114 receives a check-in message that indicates the handset entered check-in box 632, the server recalculates the check-in time for a second check-in box 636, based on the arrival time at the first check-in box 632, the user's average speed along the first route segment, i.e. through the first travel box 610. Thus, if the user arrives early at the first check-in box 632, the due time in the second check-in box 636 is made earlier.

[0145] On the other hand, if, based on the user's arrival time at the first check-in box 632, the user's speed along the first route segment, weather conditions, etc., the user is unlikely to be able to arrive at the second check-in box 636 within 45 seconds of arriving at the first check-in box 632, the campus security management server 114 recalculates the sizes and locations of the remaining travel boxes and check-in boxes.

[0146] If the campus security management server 114 does not receive a check-in message by the end of the due time window, the server declares the handset 100 to be late and can declare an alert or an emergency. However, the user might have reached the check-in box within the due time window, but the handset 100 might not have been able to send the check-in message due to a poor or nonexistent wireless network signal or network congestion. (Recall that the handset 100 can use any available wireless network, such as the wireless carrier network 102, campus WLAN 119, Bluetooth, etc., to send the check-in message.) Optionally, if the handset 100 is late, the campus security management server 114 repeatedly sends messages to the handset 100 to solicit the handset's location. If the handset responds and the travel status information provided by the handset 100 indicates that the user is traveling at a rate that would have placed the user in the missed check-in box(es) within the due time window(s), the server can treat the response as the (late/missed) check-in message(s). However, if the travel status information indicates that the user's travel rate is outside the predicted range, the server can declare an emergency.

[0147] Information about the expected quality of wireless service in each check-in box is stored in the GIS database 132. For example, no wireless signal might be expected while the user is on a covered walkway or in a tunnel 638. If wireless coverage is known to be unreliable in the area of a check-in box, the campus security management server 114 can forgo declaring an emergency as a result of a late (missed) check-in. The number of missed consecutive check-in messages that are permitted before the campus security management server 114 declares an emergency can depend on various factors, such as the quality of wireless service in the area(s) in which the handset is expected to be or a “dangerousness” rating (stored in the GIS database 132) for the route segment(s) involved. If wireless coverage is known to be poor, the campus security management server 114 allows more missed check-in messages than if the wireless coverage is known to be good.

[0148] Alternatively, several check-in boxes, more closely spaced than would otherwise be calculated, can be positioned along a route segment that is known to have poor wireless network coverage. Thus, the handset 100 has several opportunities to send check-in messages to the campus security management server 114.

[0149] FIG. 7 illustrates an example of calculating the location and size of a next check-in box after a user enters a previous check-in box. Assume line 700 represents a user's actual path (not necessarily the user's prescribed route), and point 702 represents the user's location when the handset 100 sends a check-in message. If the user continues along a straight line 704 in the direction that the user is current heading for a distance 706, the user would reach a point 708. The distance 706 is calculated by multiplying the user's expected speed by the time interval of check-ins, such as 45 seconds. Thus, if the user continued along a straight line 704, in 45 seconds the user would be expected to reach point 708.

[0150] The handset's location can be determined to within an uncertainty amount that depends on the location determination method that is used, the number of satellites in view of the handset, etc. Circle 710 is centered on point 706 (the expected future position of the user) and has a radius equal to the uncertainty amount. Thus, if the user continued along straight line 704, in 45 seconds the handset would be expected to report its position as being within the circle 710.

[0151] The user may, however, deviate from a straight path. Lines 716 and 717 form 15 degree angles 714 and 715, respectively, with line 704. A next check-in box 712 is drawn, such that two of its sides are tangent to the circle 710, and two of its corners lie along lines 716 and 717, respectively. Such a check-in box 712 permits the user to wander within a 30 degree angle from the user's starting point 702.

[0152] The frequency of check-ins can be adjusted. For example, if a rule fires (and the rule indicates that the user is in danger) or an emergency is otherwise declared, the check-in interval can be reduced, such as to one second, so the dispatcher workstation 128 can display the handset's location in near-real-time. Examples of such situations include: the user's speed exceeds a threshold value (possibly indicating the user is running away from an attacker); the user suddenly changes direction (in a manner inconsistent with the prescribed route) by more than a predetermined amount, such as 15 degrees, after traveling at least a predetermined distance, such as 35 feet, in a previous direction (possibly indicating the user has been forced from the prescribed route or is trying to avoid an attacker); or the user stops (where a stop is unexpected) for more than a predetermined period of time, such as ten seconds (possibly indicating an encounter with an attacker). Similarly, if the emergency is ended, the check-in interval can be returned to normal or to an intermediate value to more closely monitor the user, in case of a subsequent incident. These limits are, however, programmable and can be adjusted.

[0153] If permitted to do so by the user's profile in the user information database 130, the user can discontinue an automated escort by entering a personal security code and a predetermined series of keystrokes on the keypad (a “discontinuance code”) along with the user's personal security code. Alternatively, the handset 100 can be equipped to recognize the user's speech and respond to a user utterance to discontinue the escort.

[0154] Once the user reaches the destination point 608, a positive indication of safe arrival can be required, if so configured in the user's profile in the user information database 130. This indication can be a predetermined series of keystrokes or recognition of the user's voice uttering an appropriate command to the handset 100. If such an indication is not entered within a predetermined amount of time, the handset 100 raises an alarm by sending a message to the campus security management server 114.

[0155] Unless it is discontinued earlier or a positive indication of safe arrival is not required by settings in the user's profile, upon reaching the destination point 608, the escort service automatically ends and the handset 100 notifies the campus security management server 114. The handset 100 exchanges arrival confirmation messages with the campus security management server 114, which then closes the escort session in the handset. The server 114 logs the escort and may log escort details (such as the check-in locations), depending on the configuration of the system and the user permissions stored in the user information database 130. An indication, such as a text message or a sound, is generated on the handset 100 to notify the user that escorting has ended. In addition, if the user has reached the destination and wants to ensure that escorting is disabled, the user may enter a code to discontinue the escort.

[0156] If an alarm is triggered, either manually or automatically, a map showing current position and recent historical position information related to the handset 100 is displayed on the dispatcher workstation 128 to assist a dispatcher in determining how to dispatch personnel. Time stamps associated with each handset location fix make it possible to determine if the user is still moving and assist the dispatcher in determining the best intercept point. Color codes and other attributes of markings on the dispatcher workstation 128 quickly convey information to the dispatcher. These include different colors for the positions before the alarm, at the time of the alarm and the current position. Color code and line type (solid, dashed, dotted, etc.) may be used to indicate deviations from an expected course, such as an escort session.

[0157] In general, the dispatcher workstation 128 does not display information about users who are not in an alarm state. This simplifies the display, so the dispatcher can concentrate on other duties or information related to alarms. However, the dispatcher can instruct the workstation 128 to display information about users who are not in an alarm state.

[0158] Color coding is used to convey information without cluttering the display. For example, orange, yellow and red can be used to identify the nature of an alarm, such as biometric data being beyond the threshold as opposed to the user who has simply lost his or her away.

[0159] The dispatcher workstation 128 can display information about a user, such as the most recent check-in time, whether the most recent check-in was late, whether a call to an emergency service (such as 911) is in progress, a reason why the user is an alarm state as well as user information (including phone number, address, name, description and photograph).

[0160] In addition to monitoring automatically escorted users, the campus security management server 114 can monitor a mobile security force to determine current locations (including altitudes) of force personnel and to quickly identify a member of the security force who is close to a handset when an alarm is raised for that handset. Upon request from the dispatcher, software that drives the dispatcher workstation 128 displays the location of security personnel who are close (and closest) to the last known location of a handset that is in an alarm state. Furthermore, the campus security management server 114 can be configured to automatically select a member of the security force and send a message to that member's handset to dispatch the member to the site of the emergency.

[0161] Sensor data can be selected by sensor type and displayed as an overlay on the campus map. A time sequence display of sensor data over a selected period of time allows the dispatcher to observe changes in these patterns. The time sequence data can be replayed, paused, rewound and fast forwarded, and the replay speed can be varied. Additional information about the dispatcher workstation 128 is provided above and below.

[0162] The handset 100 can be configured to recognize a “stealth code” that, when entered by a user, causes the handset to send a message to the campus security management server 114 indicating that communication with the user may increase the user's risk of harm. While in stealth mode, the handset 100 repeatedly sends its position information to the campus security management server 114, such as once per second. The campus security management server 114 displays information about the handset 100 on the dispatcher workstation 128, and security personnel are dispatched to the location of the user. Covert communications with the handset can continue, such as to obtain location information about the handset or sensor data.

[0163] When the user's handset has requested stealth mode, attempts to send messages or communicate with the user using text messages are disabled. Voice communications from the user's handset are not, however, disabled. An override capability is provided. Configuration options control if stealth mode can be overridden by the campus security management server 114 or the user.

[0164] Software in the handset 100 is configured to make the handset act and appear as though all monitoring has ended, e.g. the screen of the handset does not display an indication that the handset is being monitored, and the handset appears to respond normally to keystrokes on the keypad, although the handset remains in stealth mode. Once the handset 100 enters stealth mode, only security personnel can deactivate stealth mode via an exchange of messages between the handset and the campus security management server 114 or by manual entry of disable codes on the handset by security personnel.

[0165] If an attacker instructs the user to discontinue an automatic escort, the user can enter the stealth code instead of the discontinuance code. Since in stealth mode the external behavior of the handset (as visible to the attacker) is identical to the handset's behavior when monitoring is disabled, the attacker should not be aware that the handset continues to be monitored.

[0166] The handset 100 can be configured to display a user-configurable icon when the handset is in stealth mode and to display a different user-configurable icon when the discontinuance code has been entered into the handset. An attacker may be aware that the handset is capable of entering stealth mode, but the attacker is unlikely to be aware of the stealth mode icon or the icon that indicates that the discontinuance code has been entered. Thus, the attacker cannot tell which state the handset 100 is in. Any subsequent attempts to enable or disable monitoring appear to operate normally.

[0167] When the handset is in stealth mode, displays, such as progress bars and other indications of monitoring activity, are suppressed. When in stealth mode, all necessary handset behaviors are altered to make the stealth code appear to be the deactivation code. Even attempts to enable monitoring appear to work, and the stealth code appears to act as a discontinuance code.

[0168] Stealth mode may activate additional features, as supported by the handset and configured in the user's profile, such as opening a one-directional voice channel to the campus security office (to audibly monitor the situation) and/or activating an image capture and transfer capability to transmit images from the handset to the campus security office.

[0169] In stealth mode, a call can be automatically placed to an emergency service (such as 911) and a pre-recorded message can be sent to that service. The message can identify the user and notify the emergency operator that the user is unable to speak with the operator and that the operator is requested not call back to the user. This feature can be employed if permitted by the emergency service. It is intended that the recorded message be produced by or in cooperation with the security services in order to ensure that the message meets all emergency service requirements. A system configuration option regulates whether this message can be created and/or altered without security services involvement. Different messages can be sent based on data available to the handset about the emergency, including biometric and environmental data.

[0170] As discussed above, sensors and wearable devices can communicate with the handset 100 over a wireless channel, such as Bluetooth. These devices can be configured to trigger emergency notifications via the handset, including placing calls to 911, placing calls to security services or triggering alarms. Some wearable devices are manufactured with unalterable and unique identification codes. A user can own one or more wearable devices. Each wearable devices should be tested and in the wearable devices identification code should be registered with a corresponding handset. This testing and identification code registration can be automatically controlled by the handset. The registration results in an association of the wearable devices to both the handset and the user's data record in the user information database 130. Once the wearable device is registered, the user can configure the handset to initiate calls and requests for assistance to a designated emergency service, such as 911 or campus security. This configuration information is also stored in the user information database 130.

[0171] While in test mode, the wearable device sets a test message flag in its emergency transmission message. If another handset receives the wearable device's signal while the device is in test mode, the receiving handset ignores the message, because the receiving handset detects the test flag.

[0172] The handset software recognizes and acts on all messages from wearable devices that are registered to that handset. On the other hand, if a handset receives a message from a device that is not registered to that handset, the handset and sending device are referred to as being “foreign,” relative to each other. If a handset detects a message from a foreign device, the handset composes a new message that includes the received message and the identification of the sender. The receiving handset flags the message as being received from a foreign device.

[0173] The receiving handset also includes the receiving handset's location in the new message. Because of variations in handset and wearable device features and programming, interpreting the received message is not possible at the receiving handset. The receiving handset transmits the message to a campus security management server 114 using the handset's primary means of communication, thus acting as a relay station for the received message. The message contains a unique device identification code that was assigned by the manufacturer of the device. The code carries no user information, but it permits the campus security management server 114 to identify the handset that it was assigned to and subsequently all other data associated with that handset, including the user's data and the handset's configuration information from the user information database 130.

[0174] The wearable device includes a mechanism for explicit alarm activation. This mechanism requires an action by the wearer that is unlikely to occur accidentally, in order to reduce the likelihood of false alarms. While the exact mechanism varies by device, a bracelet or watchband may trigger an alarm if opened/removed while alarms are enabled. Some wearable devices may have a normal orientation and may trigger an alarm if they are placed in an unexpected orientation for more than a programmed period of time.

[0175] If a user activates the wearable device alarm and the handset subsequently loses contact with the wearable device, the handset notifies the campus security management server 114 of the loss of contact, including the position of the user's handset at the time the signal was lost.

[0176] The wearable device communicates with the handset using standard wireless interfaces, such as Bluetooth. This creates several additional opportunities for detection, including the ability for a security officer to locate the wearable device when in close proximity to the device and for distributed wireless networking stations to detect the device. The detection of the device can provide a crude tracking mechanism when the handset is no longer in the possession of the user. Any wireless networking node capable of communicating with the device can detect and report the presence of an activated wearable device. While the position information is not precise, a succession of detections can help direct security officers to the vicinity of the victim, possibly getting close enough to detect the signal directly using portable, and possibly directional, receivers.

[0177] The wearable device supports frequency and channel hopping on standard wireless interfaces and channels, so the wearable device can interoperate with a variety of makes and models of handsets. In addition, the user is also not required to set a particular interface operating frequency or channel, because configuration of the device is automatically managed by handset and system software. This flexibility provides the ability to support interface changes introduced or mandated by the handset manufacturers, as well as maintaining the ability to communicate with the handset while complying with any changes in operating requirements imposed by the carriers. The device utilizes a common message format and encryption schemes specified by handset manufacturers to maintain user security and interoperability with all makes and models of handsets that utilize these standard interfaces.

[0178] When placed in emergency transmit mode, the device transmits a complete message on its primary interface frequency or channel. The device then automatically initiates frequency and channel hopping to potentially take advantage of nearby handsets that may operate on other frequencies. The software running on each subscriber handset monitors its primary interface frequency or channel and detects any emergency broadcast, since it recognizes the message format as well as a potentially valid wearable device ID. This provides for the possibility of detection by other subscriber handsets that use different frequencies or channels, because they are in the physical proximity of a wearable device in emergency transmit mode.

[0179] When all supported frequencies or channels have been used for emergency transmission by the wearable device, it repeats the emergency message sequence by returning to its primary interface frequency or channel assignment and then continues transmitting. Transmission continues until the campus security management server 114 is able to communicate with the device on Bluetooth or another wireless interface or security personnel physically reset the device using the device manufacturer provided tools.

[0180] If the handset is separated from the wearable device, the wearable device continues to transmit a signal that can be detected over a short distance, and the handset issues an alarm, which includes position information. The alarm is transmitted to the campus security management server 114, which begins tracking the handset. The position of the handset (when it became separated from the wearable device) is reported to the campus security management server 114. Initially, it cannot be determined if the wearable device or the handset was separated from the user. The handset can be monitored and the position of the wearable device may be detected by other handsets.

[0181] If the user intentionally drops the wearable device or the device is knocked off in some way, the handset is likely to remain with the user. If the user drops the handset, the handset is unlikely to move. The security staff know to attempt to locate the wearable device, which is likely to remain with the user. If the handset is stolen from the user, the handset is likely to continues to move, but the user is in no further danger, so no alarm need be raised. If the user has multiple wearable devices, one may be dropped and another confirms that the handset is still with the user. If more than one wearable device loses contact with the handset, it is highly likely that the handset is not with the user, unless there has been a handset failure, in which case it is difficult to determine whether or not the user is in danger.

[0182] Due to the large number of erroneous 911 calls caused by pre-programmed 911 buttons on mobile handsets, handset manufacturers no longer include these buttons on handsets. Furthermore, legislation in some states now prohibits the use of autodialing devices to call 911. However, a wearable device button functions can be programmed to allow a user to quickly summon help in the event of a personal emergency, while minimizing the possibility of unintentionally generating a 911 or other type of emergency call. The wearable device must be activated from the handset using a programmed operation on the handset to which it is registered, which transmits an activation code to the wearable device before the alarm activation will work. The wearable device is also deactivated using a programmed operation on the handset.

[0183] The primary function of a wearable device is for a user to be able to quickly summon help in the event of a personal emergency of a nature that prevents them from using their handset to make an emergency call. The wearable device can be equipped with recessed buttons, and the device can be programmed to recognize sequences of button pushes to generate an emergency call.

[0184] Depending on the type and geometry of the wearable device, one or more of the following activation mechanisms can be employed to call 911.

[0185] A two button device with sufficient space between the buttons to make it easier to press each button individually can be used to generate a call by using a two-button depression sequence. The user first presses, then releases, either button and then must press and release the other button within a maximum elapsed time.

[0186] In another embodiment, a third button is placed between the other two buttons. To activate the device, the user presses the two outside buttons without pressing the center button.

[0187] In yet another embodiment, a single button is depressed a predetermined number of times, such as four, within a maximum elapsed time to generate the call. Four button depressions is equivalent to the number of keystrokes a user would make to completely dial a 911 call using a handset. This mode could also be implemented using any one button on the two-button or the three-button device.

[0188] A call to the campus security management server 114 is not bound by 911 restrictions on autodialing. The wearable device can be programmed to call 911 in response to a button sequence, such as one of the sequences described above. The wearable device can also be programmed to call the campus security management server 114 or send a data message to the server if the wearable device detects a different button sequence or if the wearable device detects a potentially dangerous situation, such as the device is removed from the user without first disarming it, a body temperature sensor detects a temperature beyond a predetermined threshold or a pressure sensor or other device provides a positive indication of a separation of the wearable device from the user. A pre-recorded message can be played over the call, or data describing the situation, as discussed elsewhere, can be sent to the campus security management server 114.

[0189] If a user is unsuccessful in placing a call to an emergency service (such as 911), and the beacon feature is enabled, the handset requests assistance from other (secondary) handsets in the area. The first secondary handset with available telephone service that responds initiates a 911 call and links the originating handset to the 911 call. As discussed above, several secondary handsets can link together in a daisy-chain, if necessary. Depending on what the 911 service permits and supports, the secondary handset(s) may serve as only an audio relay or it(they) may also relay data. The relayed data can include the fact that the call was relayed, the identity (e.g. phone number) and location of the originating handset and the relay path (if multiple handsets form a chain).

[0190] When a handset responds to an emergency beacon request and becomes part of the relay network, audible, visual and/or tactile (e.g. vibration) indications are produced on the secondary handset(s) to notify their user(s) of the secondary handset that the handset(s) is(are) in use supporting an emergency call. The user of each secondary handset is requested to remain stationary, if possible, to ensure that the connection remains stable. When the call ends, another signal is sent to notify all handsets that acted as relays that the handsets are no longer involved in an emergency relay and their users are free to move.

[0191] If a relay connection is lost, the originating handset attempts to place a 911 call. If that call fails, the handset again requests assistance from other handsets in the area.

[0192] A similar relay mechanism is provided to connect to campus security, should the normal communications path be interrupted, which could occur under some conditions, such as localized power failures. Since this is usually a digital network connection, rather than a telephony connection, extending the network simply requires the secondary handsets to act as limited routers. The limited routing function routes only messages that are destined to the campus security management server.

[0193] Two types of locations are considered secure locations: a campus security facility and a user's “home” location. Campus security facility coordinates are captured when the system is initially configured. A system configuration option determines whether a user can program the home location or whether a security officer inside a security office must do this. The coordinates of any secure locations are stored at the campus security management server 114 and stored encrypted in the handset.

[0194] When a handset reports its position and a campus security management server 114 verifies it to be at a secure location, the secure functions of a handset can be programmed. The first such function that should be programmed is the user's security code. That code should be provided by the user when at a secure location in order to permit changing other secured features, such as alarm and stealth codes, configuration parameters that affect security functions and any other features that must be restricted to the user.

[0195] When away from a secure location, security option settings may be changed to be more restrictive and subsequently less restrictive, but generally not less restrictive than the last setting programmed while at a secure location.

[0196] For portable handsets that have different personalities when located at “home” vs. away from “home”, such as combination cellular and portable wireline telephones, the knowledge of the state of the device can be used to determine location when at “home.” A similar location capability can be used when the handset is docked in a device having a fixed, permanent location. This “docking station” can provide additional features, including serving as a charging base for the handset and the wearable device(s) and a means to permit changing certain programmable features that cannot be changed when undocked.

[0197] The user can follow a programming sequence that causes the handset to set its current geographic location as “home” using its built-in navigation receiver or can program the “home” location from a secure location. Once this “home” location is programmed into the handset, this location is considered a secure location. Only the handset proximity to this actual location or at another secure location will permit the User to reprogram certain security functions of the handset, such as the user PIN for enabling position information.

[0198] As part of the security function, the system provides for broadcast notification to all subscribers of security alerts, including weather alerts, natural disaster warnings (e.g. earthquakes), fire, bomb threats, terrorist threats, reported assaults or other potentially dangerous situations. Some warnings may define a region within which there is a hazard. The handset conveys the message and produces audible, visible and tactile (e.g. vibrating) warnings that the user has just entered the region where there is a known or suspected hazard.

[0199] When a sensor alarm indicates a risk that may affect multiple people in a region, the campus security management server 114 sends a message containing a set of coordinates that define a region and indicating a type of sensor of interest. All handsets that find that they are within the specified region and that have the indicated type of sensor report their sensor data to the campus security management server 114. These reports do not necessarily identify the sender, and they report sensor values, whether the values indicate a hazard or not.

[0200] A campus security organization may temporarily issue handsets and wearable devices to visitors, such as vendors and maintenance technicians. The devices can provide services ranging from identification and access control to monitoring and recording the places where the visitors travel on the campus. The wearable device and handset can be configured such that separating the wearable device from the handset or removing the wearable device trigger an alarm. Deviating from allowed locations causes the handset to issue a warning to the visitor and, if the visitor does not return to an allowed area, to issue an alarm. The visitor's location is reported to the campus security management server 114 frequently, and a log of where the person traveled is maintained by the server. The warnings can also help guide the visitor. A wrong turn can result in a warning, thereby guiding the person to the proper destination. Visitor authorization is typically programmed to expire at a certain time. If the visitor is present on campus near the expiration time, the handset produces a warning to the visitor. If the visitor remains on campus beyond the expiration time, an alarm is triggered. If the visitor attempts to leave campus with the handset, i.e. if the visitor's trajectory is not consistent with a return to the visitor center or security office, an alarm is generated. If the visitor attempts to disable the handset or wearable device, an alarm is generated.

[0201] A substantial number of users visit other campuses for extended periods of time to attend classes, meetings or services. The user can reconfigure his or her handset to communicate with a campus security management server other than the server on the user's home campus. The user can effect this reconfiguration by visiting the host campus security management server's web site, directly registering with the host campus security management server or by commanding the handset to automatically register upon arrival at the host campus. The user information database 130 remains on the user's home campus security management server. Portions of the user's subscriber information, including wearable device and handset information, are copied to the host campus security management server. Automated registration occurs if a handset determines that its location is outside its home campus or if the handset contacts its home campus security management server and that server determines that the handset is located within a region managed by another campus security management server. Each campus security management server provides routing services to other campus security management servers, so contact with the home campus security management server is supported on host campuses. The automated registration system is typically used for short-term visits to other campuses, such as sporting events. Manually changing registration is more typically used when a longer-term change in default campus security management server is desired.

[0202] When an alarm is generated while on a host campus equipped with a campus security management server, an emergency message is sent to the subscriber's home campus security management server. The home campus security management server determines that the event is occurring within a control region of the campus being visited and forwards the emergency message to the appropriate host campus security management server. All subscriber information, other than that previously designated as nontransferable, is forwarded to the host campus security management server.

[0203] If a subscriber generates an emergency event that is outside the control region of any campus security management server (e.g. off campus, but within communications range), the transmitted emergency message and all subsequent messages are automatically logged in the subscriber database by the home campus security management server. The Security Management System campus security management server can be configured to flag these messages for administrative review and/or to produce an operator message or alarm.

[0204] If a handset 100 is reported lost and the user authorizes remote activation, the campus security management server 114 can activate the handset and determine its location. The user selects a code, similar to a personal identification number (PIN) used for ATMs, which permits security personnel to remotely activate handset monitoring. This number is not known and is not available to security personnel, preventing security personnel from remotely activating monitoring without a user's permission and knowledge. A user can override this safeguard by altering a user profile setting that cannot be altered by security personnel.

[0205] Many handsets employ various types of keypad lockout mechanisms. Currently, these lockout mechanisms can be invoked only from the handset keypad. The software in the handset 100 provides a handset keypad emulation function to emulate the keypad sequence used to disable the keypad, as if the user had done so from the keypad. If the user misplaces or otherwise loses control of handset 100, and the user does not want to permanently disable the handset by notifying the handset carrier, the user can request the security organization to prevent use of the handset by issuing a remote keypad disable command. The user notifies the security organization that the user wishes to lockout the handset keypad and provides the security organization with the user's authorization code to activate this function. A security officer issues the remote keypad disable command on the dispatcher workstation 128, and the campus security management server 114 send a command to the handset 100 to invoke the keypad emulation software.

[0206] In one embodiment, if the handset 100 becomes separated from the wearable device 121 when the wearable device is active, the software in the handset automatically deactivates the keypad and notifies the campus security management server 114. Thus, to re-activate the handset keypad, the handset must still be in the user's possession or in the possession of a person who knows the user's security code.

[0207] Other features commonly available on other platforms, such as wireless PC and PDAs, that could serve as the handset include audio streaming and image capture. Embodiments of the campus security management server 114 can remotely enable these features when an alarm has been triggered, thereby enabling the gathering of additional data. Images may provide visual clues that help pinpoint a location of the handset, provide a picture of an attacker or information about the situation, including the number of assailants, if weapons are involved, if the victim has been injured and in what way. Audible information can include conversations, identifiable voices and additional information about the level of danger the user is facing.

[0208] Several methods of discovery by the campus security management server 114 of the presence of registered handsets are possible. Generally, discovery occurs as a result of periodic broadcast messages sent by the campus security management server 114 that request a registration. If a handset 100 receives such a message and is not current registered, or the handset receives a message from a campus other than the one where it is currently registered, the handset 100 registers with the requesting campus security management server.

[0209] If the handset 100 is registered with one campus security management server and receives a request for check-in from another campus security management server, the handset attempts to contact the first campus security management server. If the handset 100 cannot contact the first campus security management server (i.e. the handset has lost the connection), the handset attempts to register in with the other campus security management server. The second campus security management server forwards the registration request to the handset's home campus security management server for validation. The user's configuration (stored in the home user information database 130), the home campus security management server's configuration and the other campus security management server's configuration control whether the handset 100 is permitted to register with the second campus security management server.

[0210] When a handset registers with a campus security management server, the telephone number of the associated security facility is provided to the handset and is used as the active security facility.

[0211] Various types of user and handset registrations are provided to support different needs. Often, the owner of a handset may differ from the user. For example, a handset may be registered to a parent of a student or to a business. When a multiple-user handset is registered with the security management server, each user is assigned a unique identification code by the security management server. On completion of the registration and software initialization of the handset, the server then loads all user identification codes into the handset. Any registered handset user can then enter his or her unique identification code, which “locks” that user to that handset until another registered user enters their code, thereby “locking” that handset to the new user.

[0212] Registrations are configured to expire at various times, depending on expected periods of validity. Permanent employees can be registered without expiration. Students can be registered for a semester. Temporary users can be registered for a day. Temporary registrations generally provide little information and can be completed very quickly. They provide less data about the user, primarily providing identification and affiliation. However, additional data, such as purpose and location restrictions, may be entered at the time of registration. For vendors with frequent presence on campus, a registration can be created and stored, then called up a given a short-term lease (e.g. for a few hours or days).

[0213] In general, there is no need to delete users, except when one is created erroneously or when the local administration deems it beneficial to reduce the database size or eliminate stale data. When deleted, the user is initially flagged as marked for deletion and the operator can provide a reason for deletion. Prior to actual removal from the database, the system requires that a system archive be created with the user marked for deletion and containing any reasons provided.

[0214] Users can modify some configuration options and can test critical functions to ensure that the handset 100 and wearable device(s) 121 are operating properly. Most configuration changes and some testing are only permitted when the handset is located at a security facility or at that user's designated “home” location. When a user lives off-campus, a local location, such as an office, may be designated as the home location. Setting of the home location is typically done during initial setup and prior to normal operation.

[0215] Configuration changes that increase handset security settings may be performed when away from home, but changes that would decrease handset security settings below the last setting done at home or changes to security codes are not permitted when away from home.

[0216] Test functions are provided that allow a user to verify most functions, including the ability to connect with the campus security management server 114, operation of position determining functions, check access codes and test wearable device communications. Checking of access codes is permitted only at the home location, while verification of communications, positioning support and wearable device operation are possible at any time. For example, the tests for communications between the handset and wearable devices report either that a failure was detected or no failure was detected. No indication is provided as to whether such devices exist or how many there are.

[0217] To begin a test, the user selects a test mode on the handset and is presented with a list of options that depend on the user's location and the configured options. If the handset is unable to determine its location, it assumes that it is not at home. All options are presented when the handset 100 is at home, but a more restricted list of options that do not reveal security information is presented when the handset is not at home.

[0218] The handset can collect all stored data, including routes, contact information, directories, options, etc., tag it with a version, compress it, encrypt it and upload it to the user database 130, which stores the data on behalf of the user. The user is able to retrieve the archived data and download it to a user's new handset.

[0219] The campus security management server 114 is the central data repository, registration station, coordination station, display station and primary security officer interface to the system. It receives all emergency notifications, monitoring requests and position reports. It provides the security officer with the visual and audio interactive capabilities. Every report or action involving the campus security management server 114 is logged and time stamped. Key attributes, such as type of action or report, location, value reported, etc. are logged.

[0220] When a member of the security organization logs into a campus security management server 114 via the dispatcher workstation 128, the access rights, display format and options programmed for that person are used to initialize the operation. The system logs (stores) when the person logs into and out of the workstation 128.

[0221] The key components of the user interface are the map window(s), route selection window, user data window(s) and dispatcher window. The map windows show campus features and handsets being monitored. The map views can be zoomed in for more detail or out for a wider perspective. Displays of trajectories of non-emergency monitored handsets can be disabled and displays of emergency trajectories can be moved to separate map windows. Various overlays are available that can be enabled or disabled, including security personnel and visitors. The route selection window provides a static map of the campus with location designations and provides a lookup capability by address, building name, building/room number and key terms. A route selection map has available overlays for signal coverage, lighting, security patrol routes, path status (such as snow plowing) and temporary changes, such as construction. The user data window is enabled for emergency monitoring only, and only with appropriate privileges. The dispatcher window provides controls for interactions with users and security staff.

[0222] One or more peer servers contain user data, the GIS database 132 and connections to the location assistance (GPS/WAAS) receivers 122. Users are primarily associated with one campus security management server 114, but can have one or more designated backup campus security management servers. When multiple campus security management servers are available, each server has a primary set of users, but the server can be configured to act as a backup server for other users. Each server provides local storage redundancy and may provide remote or alternate site redundancy as well.

[0223] One or more dispatcher workstations 128 serve as workstations for security personnel. They provide administrative support for registering new users, changing options that require security assistance, communications capabilities, information display and route selection. Three levels of access are enforced: security administrator, security officer and dispatcher. The security administrator level has all privileges, including the privilege to change security system settings. The security officer level has most privileges, including access to user data when an alarm has occurred. The dispatcher level allows only route selection support and routine monitoring. Security administrator privileges are not provided to system administrators by default. It is necessary to assign a primary security administrator when the software is first installed and only a security administrator is permitted to change campus security management server access levels.

[0224] The dispatcher workstations 128 may be configured to provide full redundancy or separation of responsibilities. For example, certain regions can be handled at each workstation 128 or alarms may be handled at different workstations that do not handle other activities. One primary person is typically designated to handle any requests not specifically routed to a certain person or workstation 128. It is possible to divide work through one of several mechanisms, including an escalation mechanism, in which alarms are sent to a different workstation 128; a regional distribution, in which the current location of the user determines who handles the alarm; or through a supervisory assignment function, in which a user is assigned to an officer. The assignment function can be used to reassign responsibilities as well.

[0225] The dispatcher workstation 128 is used when a user has requested monitoring or when the campus security management server 114 receives an alarm message. The positions reported by the handset are displayed on a map, showing the position of the handset at the time of the report and any relevant previous positions that are available. Maps can be zoomed in or out to show more detail or to show a full trajectory, planned route or more information about the environment, such as the current position of security officers. When regions, classes or groups of monitored routes are separated into multiple windows, the windows can be arranged on the display by dragging them, resizing, minimizing and maximizing them. The settings that are active are retained so that an officer can log out and restore a preferred screen layout at the next login. Trajectory-specific settings are not retained, since they are not likely to be appropriate when the officer logs in again, but any settings and arrangement related to regions and groups is stored.

[0226] While being monitored, the campus security management server 114 collects, retains and displays all position reports. In the case of an alarm, any previous positions recorded by the handset 100 is transmitted and the campus security management server 114 displays any information that is less than ten minutes old. Older reports that were previously provided are retained and can be displayed upon request.

[0227] In either case, individual reports are shown as small geometric shapes (such as circles, squares, triangles and a star) and are connected by lines. An exemplary display is shown in FIG. 8. A square designates a starting point (or the oldest available historical data) and an ending point for monitoring. A circle designates an intermediate report (without a change in direction) or a first displayed report of historical alarm data (when more reports are available, but none is displayed). For example, circles 800, 802, 804 and 806 represent reported (checked-in) locations for a user. A triangle, such as triangle 808, designates a point where a change in direction occurs. A star, such as star 810, designates the latest reported position for a handset 100. The entire planned route is displayed when monitoring, with past reports shown as filled shapes, such as circles 800–806, and future expected reports shown as open (unfilled) shapes, such as circle 811.

[0228] The lines connecting the shapes vary in style and color to convey additional information. Different colors are used for each trajectory displayed on one screen. Solid lines, such as lines 812 and 814, are used for historical data and dotted lines, such as line 816, are used for future segments of planned routes. An emergency trajectory (a path followed by a user for whom an alarm is active) is bold, as show for line 818. Such a line is green for points prior to the alarm, yellow at the point of the alarm and continuing to the last reported position and red at the last reported position. Any overdue report is red and flashing. As with non-emergency monitoring, historical shapes and lines are filled and solid, while planned future points are open and dotted. A semi-transparent overlay is available showing signal coverage in order to help the security officer assess the likelihood of a missed update due to signal loss.

[0229] The campus security management server 114 provides several data display management capabilities to assist in managing trajectory monitoring. Monitored trajectories may be clustered by map region selection or by manually selecting trajectories to group on a display. This is especially useful in order to maximize map detail and assist in isolating individual trajectories, which is easier when displaying a smaller area. A map window can be opened and a trajectory can be dragged into the window, displaying a map region that contains the trajectory and the selected destination. This can be used to either group trajectories or to provide a map window for a single trajectory.

[0230] Positioning the mouse over a point causes the position (description) and time of a report to be displayed. Clicking on any part of the displayed trajectory when an alarm is active and with the appropriate privileges results in a display of the user data in a separate window. A button is provided that allows a trajectory to be moved into a separate map window and an option is provided to cause a separate map window to be opened automatically when an alarm is generated. When a map window displays an active alarm, changing the focus of the display to that window automatically places the user data in the data window. This ensures that the user data window is always consistent with the trajectory that is in focus.

[0231] Positioning the cursor over any active trajectory or point causes the system to display a summary data table for a few seconds. Right-clicking on any active trajectory or point provides a list of options from which the summary data can be selected. In this case, the window is movable and remains present until closed with a line connecting to the last reported position of the associated user. This window includes the name, status, closest labeled location, grid location, height relative to ground level and floor, if appropriate.

[0232] In most cases, a windowed display is adequate to manage the user population. However, in some installations, such as those with large user populations and large campus areas, it may be desirable to set up multiple-display workstations that allow for large area displays, close up map displays, separate user data displays, etc. The campus security management server 114 supports a desktop metaphor and can be used with display capabilities ranging from single-monitor displays, through multiple-monitor displays to large display walls.

[0233] At any time a monitored user's trajectory goes beyond a map window, the display is either shifted or rescaled to bring the new point into the display. If the display can be shifted without losing any data points from the last ten minutes of any trajectories in that window, the display image is moved. Otherwise, the display locates the trajectory that is most likely to reach an edge of the display next, based on the amount of movement between the last two reports. The image is rescaled to provide at least enough space at each edge to accommodate one more sample with the same interval size.

[0234] A legend is automatically generated for any elements that are currently active (e.g. routes, signal coverage, etc.), including icons, line colors and shading colors.

[0235] Security officers' positions can be displayed overlaid on the screen or can be suppressed. Any officer that has been dispatched to a user is shown in this window in color, while other security officers are shown in gray. Officers not involved with this user may be suppressed by clicking on an on-screen button. The trajectory for the dispatched officer can be shown along with the trajectory of the user and an approximate time to intercept. This trajectory display can be made less significant in order to see the user trajectory more clearly, by displaying the trajectory as a series of dots representing position reports.

[0236] A security officer can be selected and dispatched to assist the user simply by clicking on the security officer's icon. This opens a communication channel to dispatch the officer. It also pops up information about the officer, including identity, rank, type of vehicle or other information that the security office deems significant.

[0237] When a request for monitoring or an alarm is received at the campus security management server 114, a list of actions is displayed as a checklist. The checklist is customized based on data provided by the user and/or the handset 100 and data stored in the user information database 130 and/or the GIS database 132, as well as data from other parts of the system. In addition, other actions are provided in a list that the security officer or dispatcher may choose from to augment the automatically generated list, based on information that is provided verbally or in some other manner. Some items are shown and checked off. For example, if the security office is being notified of a call that was placed to an emergency service (such as 911), “Notify public safety agencies” is listed and checked off.

[0238] If multiple officers are participating in handling the event, multiple dispatcher workstations 128 may be in use. All displays related to a single event are automatically kept consistent.

[0239] When a user data window is available, several push buttons are available in the window, including configurable buttons for customizing an installation. Among them are buttons to call the user, request an image from the user's handset 100 or a device communicably linked to the handset, show the planned route, show security officers' positions or notify police or an ambulance. A mute button is provided to allow audio monitoring while suppressing extraneous noise from the security center.

[0240] Displays are prioritized so that a new alarm causes a trajectory to be highlighted. Map windows are, by default, set to separate trajectory displays into three categories: monitored, warnings and alarms. A button is provided to combine or separate these classes of trajectories. When separated, any update to a higher priority (e.g. from warning to alarm) causes the window containing the upgraded trajectory to be maximized and moved in front of any lower priority window(s), and the window border is made to flash. Any position update in a window with an active alarm causes the window to move to in front of other windows.

[0241] The campus map data are uploaded from field data collection and from existing GIS databases (such as GIS database 132) to populate the basic infrastructure database, including labels, where available. A labeling function is also provided to display the campus map with each mapped location without a label highlighted in turn with a request for the operator to enter a label description. This allows physical locations of all primary designated points to be labeled. The primary designated points are those that represent permanent, recognizable points of demarcation, including intersections of roads and walkways, rooms in buildings, entry points into buildings, gathering points such as bus stops, event venues, stores, cafeterias, etc. There are two types of designations: points and regions. Point designations have coordinates and limits. Limits are specified as a horizontal radius and a vertical height, defining a cylinder. Regions consist of a list of points or a list of regions. The points can be designated as boundary points, such as by using a radius of 0, to define a contained region can or can be used to define a region as a series of points with non-zero radii. Boundary points are used to define large areas or areas that are difficult to map with one or more cylindrical point designations, while a sequence of cylindrical point designations can more easily map a curved walkway. A smoothing function automatically smoothes the edges of a region defined by a sequence of cylinders.

[0242] Secondary points or regions are used to further qualify defined regions. For example, secondary points can define a “west sector of an open area” or a “back of the store.” They “belong to” (are associated with) a region, so they have a region identifier in addition to the attributes of a point or region. For purposes of meaningful designations, regions can also be composed of a list of regions. This permits the number of points that define a simple region to be bounded and keeps the definitions of these regions manageable, but it permits compound regions of arbitrary complexity. A simple region can be tagged as a member region, so it is not given a label and is not used as a destination, avoiding cluttering of maps and lists.

[0243] When selecting a region, a larger region that contains a region of interest may be specified. After a region is selected, a list of contained regions may be requested. This can be helpful, because one of the entries in the list of contained regions might suggest a more specific region of interest to select.

[0244] Signal coverage is mapped when coordinates are mapped. Coverage mapping includes identification of all signals employed by the system, including GPS satellite visibility, WAAS satellite visibility, cell tower reception, wireless LAN router visibility, Bluetooth availability, etc.

[0245] While field strength metering can be performed and atmospheric conditions can be factored in, generally there is only a need to designate field strength at a point as one of three qualities: reliable, unreliable or absent. If actual measurements are taken, intervening points can be estimated using linear interpolation. Despite inaccuracies inherent in this approach, it provides adequate accuracy for the intended purpose. When signals are simply recorded on the three-step scale, any point surrounded by reliable points can be declared reliable. Any point that is bounded on at least one side by a point having a reliable signal and bounded by at least one other point having an unreliable or absent signal can be considered unreliable. Any point surrounded by points having unreliable signals or bounded by a combination of unreliable and absent points can be considered unreliable. Any point surrounded by points having absent signals can be considered absent. It is desirable to provide a sufficiently dense sampling to make this algorithm effective. Generally, samples every 500 feet are desired, but samples every 1000 feet in each direction are adequate. If samples are less dense, a weighted average algorithm can be used based on the distance to each sample point and a score of 0 for absent, 1 for unreliable and 2 for reliable. The result is based on rounding, with 0.0–0.5 interpreted as absent, between 0.5 and 1.5 as unreliable and above 1.5 as reliable.

[0246] An approximate coverage map for each transmitter, when available, is used to assist in rapidly projecting the likely impact of loss of a transmitter. Using radial distances specific to each type of transmitter as approximations of coverage for each transmitter, the outer 10% of the radius defines the portion of the coverage area considered unreliable, with the inner 90% of the radius assumed to define a reliable region. This algorithm can be used to calculate an initial condition within the area affected by a transmitter that is known to have gone down. Actual communication from handsets can be used to correct this data over time. If a communication is received from a point that is currently characterized as absent, the point is recharacterized as unreliable. If a second communication is received from the point, the point is recharacterized as reliable. After each characterization update, the averaging algorithm discussed above is applied for points from which no calls have been received.

[0247] At each point, a designation may be flagged as an illumination source. Data about the types of light fixtures and their illumination models can be stored in the GIS database 132. The models can come from vendor data or from field mapping of the boundaries of constant illumination. Regions of illumination can be defined to account for obstructions that cause irregular illumination.

[0248] Temporary loss of illumination can be logged via the campus security management server 114 when a security officer is notified that an illumination source is not operational. Since the map consists of individual point and pattern data, the map can be recalculated immediately. When notified that the problem has been resolved, this temporary outage can be removed from the system. Periodically, based on a period entered when the outage is recorded or at subsequent reconfirmation, a security officer is presented with data about the outage and asked to reconfirm that it is still out.

[0249] A foliage map contains information about ground vegetation and trees and can be used to select routes. The information can indicate regions where satellite signals are obscured, lighting is shaded or attackers can hide. This information can also be used to estimate signal strengths from satellite, wireless carrier, WLAN and other wireless networks. The map can be based on photogrammetric data and can be updated occasionally as plants grow, die or landscaping is changed. Optionally, the system can estimate growth rates for plants.

[0250] Temporary changes in infrastructure, such as construction, can be identified using the normal position mapping capability to identify the boundaries of a blocked area. This is taken into account when planning routes. Users who wish to dictate their routes can be informed about an obstacle.

[0251] Temporary changes in route availability due to weather, accidents, crowds or special events may require that these routes remain unused by users. When the blockages are created on the security display, an expiration time is associated with each blocking feature. When the time expires, the operator is notified and can renew or confirm cancellation of the temporary route blockage. If the blockage is planned, the blockage can be scheduled in advance. A starting time is provided and the blockage is assumed to be present at that time and until expiration is confirmed. Any route that passes through a blocked location at or after the starting time should avoid including that region in the proposed route, even if the route begins before the blockage begins.

[0252] Temporary blockages are sometimes identifiable from late reports (i.e., handsets not arriving at check-in boxes before the respective due time windows expire). When a user's check-in report is late and the location reported is not the next expected point, it is possible that the user has taken a detour to avoid a temporary and undocumented blockage. If the user returns to the planned route, this becomes more likely. If a second user apparently detours in the same area, a temporary blockage is added to the routing database, along with an expiration time of 30 minutes. In the meantime, security personnel can confirm or reject the hypothesis, or a voice communication with a user can confirm or reject the hypothetical blockage. If the hypothesis is confirmed, the expiration time can be extended. On the other hand, if the hypothesis is disproved, the blockage can be removed from the GIS database 132.

[0253] When it has been determined that the handset 100 is unable to provide location information, possibly due to a handset or wireless network malfunction, the user may request an in-person security escort, if available, or a semi-automated monitoring service. Semi-automated monitoring utilizes occasional calls or messages exchanged between the user and the security organization to verify that the user is progressing toward the destination and not in danger. Semi-automated monitoring relies on route selection and an agreement between the user and the security organization on call-in points. Typically, fewer call-in points are used in semi-automated monitoring than check-in points would be used in automatic monitoring of identical routes.

[0254] The security officer enters information about the call-in points into the dispatcher workstation 128, and the campus security management server 114 calculates estimated arrival times at the respective call-in points and stores call-in due time windows in the same way the server calculates check-in due time windows. The security officer expects the user to follow the prescribed route and call in upon reaching the call-in points. Each time the user calls in, the security officer manually enters data via the dispatcher workstation 128 to update the user's travel status. The normal late update alarms are in effect. Depending on the type of system deficiency, the campus security management server 114 may be able to send reminder messages as responses to a late call-ins. If so, the reminder messages prompt the user through audible or tactile announcements.

[0255] If the campus security management server 114 does not receive a check-in by the end of its due time window, the server consults its database of signal coverage and determines if the likely explanation is loss of signal. If it determines that the signal is known to be weak in the check-in box and that there is no backup wireless infrastructure that should have been used by the handset to send the check-in message, the state of the user is upgraded to warning, but an alarm is not yet generated. An additional timeout period is established, based on the planned trajectory and signal coverage maps, but the additional period is not later than the next expected check-in due time.

[0256] The security officer can utilize several methods to automatically connect with the user in order to attempt to determine if there may be a problem. The monitor need only position the cursor over that user trajectory on the monitor display and select “Call Default” to place a call using the connection method tagged as most reliable. Alternatively, the security officer can select “Call” to provide a list of available communications channels.

[0257] If the user fails to answer the handset, the security officer can send a high priority message to the handset informing the user that voice communication with the security organization is required. The campus security management server 114 attempts to use multiple communications networks if the primary communications network connection does not result in a connection.

[0258] In the event that the security officer is unable to contact the user and cannot verify the status of the user's handset, the security officer can elect to dispatch a security officer to the known site or last known location of the user in order to determine if there is a problem.

[0259] The loss of a communications site (e.g. cell tower) can result in a significant change in coverage. The outage can lead to false warnings and alarms, because the coverage data may not be accurate during the outage. By detecting such situations and informing the security staff of the approximate impact, appropriate changes can be made in response to events in the affected area.

[0260] Multiple late check-in reports in an area may indicate such a situation. For example, if a report is late and it is found to be a delayed report of the intended position plus an additional position along the correct route, it is likely there was a transmission failure at the missed point. Once verified, the operator can indicate each case, from which the campus security management server 114 can build an overlay indicating an area of temporarily compromised coverage. Additional techniques can be used to correct coverage data including sensor stations that detect loss of signal and arrangements with wireless carriers to report outages.

[0261] Temporary outages are maintained as separate overlays. If detailed mapping was not performed, these overlays may be only approximations. The overlay is built as a union of circular regions centered on points of missed reports after verifying that such events were not false alarms. An operator action is required to add a point to the outage map. A timeout is provided, after which the operators are reminded that the coverage outage needs to be reconfirmed or will be removed from the system.

[0262] All functions available at the campus security management server 114 can be made available to mobile stations in cars or even on portable computing devices through a proxy capability. Most mobile stations support only a subset of the capabilities of a campus security management server due to limitations of the mobile device. Each time the capability it is deployed, it is explicitly enabled (and thereafter periodically or occasionally re-enabled) from a central campus security management server 114. If the capability is not re-enabled within a timeout period, the capability is automatically disabled by the campus security management server 114. A warning message is issued at the central campus security management server 114 a predetermined amount of time before a mobile station is automatically deactivated. If the station's lease is not extended within a station-specific time period, it is disabled. All mobile campus security management servers are continuously monitored and a map of active mobile stations is maintained on all central campus security management servers.

[0263] A remote, or alternate campus security management server, usually located at another campus, can connect to a local campus security management server 114 in order to provide support for users when they are on a remote campus. An authentication process is required for each user requesting remote campus access. Once authenticated, the remote campus security management server is capable of accessing user data stored on a home campus security management server. Information is provided to the remote campus security management server only when a monitoring request or validated alarm is relayed to the home campus security management server.

[0264] To facilitate integration with existing systems, both static and dynamic data import and export capabilities provide field mapping and type conversions so that existing data can be imported and data produced can be exported. GIS data can be imported and updated GIS data can be exported. Portions of the user information database 130 can be populated from data in existing employee and student databases to avoid multiple data entry. Alternatively, this user information can be fetched from the existing employee and student databases when it is needed, thereby avoiding storing duplicate information. Information gathered in the registration process that complements existing student records can be transferred to the employee and/or student databases. Dispatch and security management software can be made to operate cooperatively or can be integrated, since the system does not assume that it is a standalone master system, making all capabilities potentially encapsulated within another complementary application.

[0265] Active data can be available in a form that is accessible through standardized interfaces, including ODBC and serial data streams. These make it possible to tie into other applications and databases that support such interfaces and allow the use of existing applications for many common activities and use the campus security management server software directly and simultaneously, when required.

[0266] Extensive logs are maintained. Every event that produces data, from registration and check-in to alarms and position information, is logged. Furthermore, any communication can be recorded and logged, depending on configuration settings. Every entry is time-stamped and tagged with originator information. Changes that affect system capabilities, such as loss of a cell site, are logged. Response times can be measured for alarms and all actions taken are recorded.

[0267] Reports provide information about who knew what and when, why information was not available (such as lack of handset support, disabled by user configuration, not requested by a user, as indicated by audio recording of a conversation between the user and a security officer). Various standard reports are provided showing the amount of activity by type, false alarm statistics, account activity, activity by time of day, etc.

[0268] Features are built into the system to permit simulations and drills for training. By directing handsets to use a specified campus security management server 114, a drill can be set up even on a campus with an active system to train new staff. Simulated messages can be sent and a training database can be used. Live campus security management servers do not display or respond to handsets or regions that are identified as under test. A campus security management server 114 can be equipped to receive or exclude all normal active data in addition to test communications while acting as a testing station. Outgoing notifications can be initiated by the operator under test and produce a simulated response sufficient for testing that expected operator actions are taken.

[0269] Each testing action is logged separately from normal actions. An evaluation component is provided with a testing scenario, which also contains relative events that specify that a response is to occur following some event. The interval between the event and the response is measured and reported. A report is generated that compares actual behaviors with expected behaviors and reports on consistency or deviations from the programmed expected behaviors.

[0270] A handset and a server have been described as each including a processor controlled by instructions stored in a memory. Those skilled in the art should readily appreciate that instructions or programs defining the functions of the present invention can be delivered to a processor in many forms, including, but not limited to information permanently stored on non-writable storage media (e.g. read only memory devices within a computer such as ROM or CD-ROM disks readable by a computer I/O attachment) or information alterably stored on writable storage media (e.g. floppy disks and hard drives). In addition, while the invention may be embodied in software, the functions necessary to implement the invention may alternatively be embodied in part or in whole using firmware and/or hardware components such as Application Specific Integrated Circuits (ASICs) or other hardware or some combination of hardware, software and/or firmware components.

[0271] While the invention is described through the above-described exemplary embodiments, it will be understood by those of ordinary skill in the art that modifications to, and variations of, the illustrated embodiments can be made without departing from the inventive concepts disclosed herein. For example, although embodiments were described in relation to a handset monitoring the location and movements of the handset and comparing that information to set of rules, the handset can send the location information to the campus security management server, and the server can compare that information to the set of rules. Accordingly, the invention should not be viewed as limited, except by the scope and spirit of the appended claims.