The importance of surveillance in our daily life has been constantly growing in the past couple of decades, and with that, also the need for more efficient and sophisticated mechanisms for surveillance. One of the major challenges comes from the need to perform surveillance in large and complex environments, where it is not always feasible or cost effective to have complete surveillance coverage of the entire area at all times. Furthermore, sensors might not always be able to classify threats, and often require human intervention to assess the threat level. It can thus be necessary to deploy multiple mobile sensors, that work together with conventional static sensors to maintain a sufficient level of knowledge on the location of a potential threat. This is particularly crucial in applications where it is necessary to monitor a potential threat which can move over a large area until it can be accounted for.
In a formal setting, designing a surveillance strategy for a (mobile) sensor network dealing with a potentially adversarial target can be modelled as a two-player game in which one player represents the sensor network and the other player represents the adversary. There are several variants of such games, including pursuit-evasion games  and graph-searching games . In such games, the problem is formulated as enforcing eventual detection, which is, in essence, a search problem – once the target is detected, the game ends. These types of games are too restrictive for applications where the goal is not to capture, but instead to maintain information about the location of the adversary for an unbounded time horizon.
Another class of games used in physical security are Stackelberg games, also known as leader-follower games. In such games the defender acts first, for example by placing their defence system, and the attacker follows with his action, possibly after obtaining information about the placed defence system. In recent years Stackelberg games have seen use in, among others, LAX airport,  and the US Coast Guard . These games aim to compute randomized policies for the defender to protect target locations from an attacker. Extensions of this model  have been proposed to generate infinite-horizon patrolling strategies either for mobile resources alone or in concert with static alarm triggers [6, 7]. However, these models cannot be used to reason about the uncertain set of possible locations of dynamic threats.
Our objective in this work is not to just compute a patrolling strategy for the mobile sensors, but also to quantify the sensor network’s knowledge of the possible locations of active threats and use this information to synthesize strategies for the mobile sensors that provide knowledge guarantees on the threat location over an infinite-time horizon.
As a motivating case study we consider the use of autonomous drones working in cooperation with static sensors in wildlife conservation. UAVs are increasingly being adopted for monitoring of illegal hunting and poaching , though they are mostly remotely controlled . In Kenya, for example, remotely controlled drones were deployed in 2014 in an attempt to reduce poaching by providing constant surveillance , allowing authorities to arrest rhino poachers when they are sensed by the drones. Autonomous UAVs have not been used in this setting yet, and proposed plans involve drones following pre-programmed paths . In this paper, we propose a method for automatically constructing autonomous reactive surveillance strategies for multiple mobile sensors (like UAVs) working in concert with static sensors in the field.
We study the problem of synthesizing strategies for enforcing temporal surveillance objectives, such as the requirement to never let the sensor network’s uncertainty about the target’s location exceed a given threshold, or recapturing the target every time it escapes. To this end, we consider surveillance objectives specified in linear temporal logic (LTL), equipped with basic surveillance predicates. Our computational model is that of a two-player game played on a finite graph, whose nodes represent the joint possible locations of all the mobile sensors and the target, and whose edges model the possible (deterministic) moves between locations. The mobile sensors play the game with partial information, as they can only observe the target when it is in the area of sight of one of the sensors. The target, on the other hand, always has full information about the locations of all sensors in the network. In that way, we consider a model with one-sided partial information, making the computed strategy for the agent robust against a potentially more powerful adversary.
We formulate surveillance strategy synthesis as the problem of computing a joint winning strategy for the multiple mobile sensors in a partial-information game with a surveillance objective. Partial-information games with LTL objectives have been well studied [12, 13] and it is well known that the synthesis problem is EXPTIME-hard [14, 15]. In a companion publication at CDC 2018 we describe a framework for formalizing single-agent surveillance synthesis as a two-player game with partial information, and propose an abstraction-based method for solving such games. The interested reader is referred to the extended version  for details about the abstraction-based synthesis method. The price of resorting to abstraction is the potential overapproximation of the set of possible target locations (that is, loss of precision in the sensors’ knowledge) which may make satisfying the surveillance requirements more difficult. There is thus a trade-off between the strictness of the surveillance requirements, i.e, how closely a target needs to be tracked, and the size of the abstract game necessary for a surveillance strategy to exist.
Sensor networks consisting of a large number of dynamic sensors, as well as static sensors, can achieve better coverage, and thus, in general, can make do with much coarser abstractions to satisfy a given surveillance objective. However, even when using abstraction, the size of the game is exponential in the number of sensors. To address the blow-up of the state space incurred by a large number of sensors, we propose a decentralized synthesis method that aims to compute a surveillance strategy for each mobile sensor separately.
Contribution: Our contribution is as follows. We decompose the original surveillance game into a set of subgames, one for each sensor. Accordingly, the global surveillance objective is broken up into a local objective for each subgame. Our reduction guarantees that if the local strategy in each subgame satisfies the local surveillance objective, then the composition of the strategies fulfills the global surveillance objective. This allows us to solve each subgame under its local surveillance objective independently, using off-the-shelf reactive synthesis tools.
There has been work in decentralized synthesis for GR(1) specifications, however, the synthesis process often involves a centralized computation as in  or synchronization [18, 19]. Our approach, on the other hand is fully decentralized and the sensors require no coordination as simply satisfying their local properties guarantees the global objective.
Ii Motivating Case Study
We first describe the multi-agent surveillance synthesis problem informally, in the context of a motivating case study.
We consider wildlife conservation in Africa, in particular, at the Selous Game Reserve (SGR) located in Tanzania, where the African Black Rhinoceros population is under serious threat due to poaching. We are motivated by a recommended anti-poaching initiative in the SGR by the World Heritage Centre, to study the use of a sensor network for tracking the position of a potential poacher with user-specified precision. Since the SGR is a very large area, the network consists of both mobile and static sensors. We apply the distributed synthesis method proposed in this paper to synthesize surveillance strategies for the mobile sensors that satisfy the desired tracking requirement.
Figure 1 shows a section of the SGR that we represent as a gridworld which will form the state space of the game. Each static sensor monitors a given area of the grid (shown in yellow) and detects any presence of the target (i.e., threat) in these states, but cannot determine the target’s exact location. The requirement is to ensure that over and over again, the set of potential locations of the target is reduced to cells. In other words, every time the target escapes from the vision of all sensors, the network guarantees that eventually the uncertainty about its position will be reduced to grid cells.
Iii Games With Surveillance Objectives
We begin by providing a formal model for describing multi-agent surveillance strategy synthesis problems, in the form of a two-player game between the mobile sensors in a network and a target, in which the sensors have partial information about the target’s location.
Iii-a Multi-Agent Surveillance Game Structures
We define a multi-agent surveillance game structure to be a tuple where:
is the set of states, where is the set of joint locations of the mobile sensors, is the set of possible locations of sensor , and is the set of possible locations of the target;
is the initial state;
is the transition relation describing the possible joint moves of the sensors and the target; and
are the visibility functions for the sensors, where maps a state to iff position is in the area of sight of .
Additionally, we define the joint visibility function that maps a state to iff the set is non-empty. Informally, is if the target is in view of at least one of the sensors.
The transition relation encodes the one-step move of the target and the sensors: First, the target makes a move, and then, the sensors move jointly in a synchronized manner.
We denote with the projection of the transition relation on the sets of locations of the target and the sensor with index . Formally, we define
For a state we define to be the set of possible successor locations of the target:
We extend to sets of locations of the target by stipulating that for , the set consists of all possible successor locations of the target for states in . Formally, let .
For a state and a successor location of the target , we denote with the set of successor locations of the sensors, given that the target moves to :
We assume that, for every state , there exists a state such that , that is, from every state there is at least one move possible (including self transitions). We also assume, that when the target moves to an invisible location, its position does not influence the possible one-step moves of the sensors. Formally, we require that if , then for all . This assumption is natural in the setting where each of the sensors can move in one step only to locations that are in its sight.
Figure 2 shows an example of a multi-agent surveillance game on a grid. The sets of possible locations and for the each of the sensors and for the target consist of the squares of the grid. The transition relation encodes the possible one-step moves of all the sensors and the target on the grid, and incorporates all desired constraints. For example, moving to a location occupied by another sensor or the target, or to an obstacle, is not allowed. In this example, the function encodes straight-line visibility with a range of 2: a location is visible to sensor from location if there is no obstacle on the straight line between them and the distance between the target and sensor is not larger than 2. Initially the target is not in the area of sight of the sensors, but the initial position of the target is known. However, once the target moves to one of the locations reachable in one step, in this case, locations , this might no longer be the case. More precisely, if the target moves to location , then the green sensor observes its location, but if it moves to one of the other locations, then neither sensor can observe it, and its exact location will not be known.
Iii-B Static Sensors
We now describe a way to incorporate static sensors in the multi-agent surveillance game framework. Let be a multi-agent surveillance game structure as defined previously.
We identify a static sensor with a set of locations over which it operates. A surveillance game can have multiple static sensors (or none). Let be a given set of static sensors for . For each location we define to be the set of all indices of static sensors such that belongs to the corresponding set of locations, i.e, . We refer to as the set of triggered static sensors at location . We also define for a set of locations .
We assume that sensors do not suffer from false positives or negatives (studying these is an avenue for future work).
Iii-C Belief-Set Game Structures
In surveillance strategy synthesis, we need to state properties of, and reason about, the information which the sensors have, i.e, the belief about the location of the target. To this end, we can employ a powerset construction which is commonly used to transform a partial-information game into a perfect-information one, by explicitly tracking the joint knowledge of the sensors as a set of possible locations of the target. In that way we define a two-player game in which one player represents the whole sensor network, and the other player represents the target.
Given a set , we denote with the powerset (set of all subsets) of .
Given a multi-agent surveillance game structure with static sensors , we define the corresponding belief-set game structure where:
is the set of states, where is the set of joint locations of the sensors, and the set of belief sets describing information about the location of the target, and is the set of possible sets of triggered sensors;
is initial state;
is the transition relation where iff for some and , , and one of the following three conditions is satisfied:
, , ;
, and .
Condition (1) captures the successor locations of the target that can be observed from one of the mobile sensors’ current locations. Condition (2) captures the cases when the target moves to a location that cannot be observed by the mobile sensors, but triggers a non-empty set of static sensors. Finally, condition (3) corresponds to the successor locations of the target not visible from the current location of any of the mobile sensors, and not triggering any static sensors.
Based on , we can define the functions and similarly to the corresponding functions defined for .
A run in is an infinite sequence of states in , where and for all .
A strategy for the target in is a function such that implies for every and . That is, a strategy for the target suggests a move resulting in some belief set reachable from a location in the current belief, and a set of triggered sensors.
A joint strategy for the sensors in is a function such that, if, then, , , and for every , and . Intuitively, a strategy for the sensors suggests a joint move based on the observed history of the play, the current belief about the target’s position, and the set of currently triggered sensors.
The outcome of given strategies and for the sensors and the target in , denoted , is a run of such that for every , we have , where .
Iii-D Temporal Surveillance Objectives
We consider a set of surveillance predicates , where for we say that a state in the belief game structure satisfies (denoted ) iff . Intuitively, is satisfied by the states in the belief game structure where the size of the belief set does not exceed the threshold .
We study surveillance objectives expressed in a fragment of linear temporal logic (LTL) over surveillance predicates. We consider safety surveillance objectives expressed using the temporal operator and liveness surveillance objectives expressed using the temporal operators and .
A safety surveillance objective requires that the size of the belief-set never exceeds the given threshold . More formally, an infinite sequence of states in satisfies the safety property if and only if for every it holds that . A liveness surveillance objective , on the other hand, requires that the size of the belief is smaller or equal to the bound infinitely often. That is, in satisfies if for every there exists such that .
In this paper we consider safety and liveness surveillance objectives, as well as conjunctions of such objectives. We remark the following equivalences of surveillance objectives:
if , then .
Using these equivalences, we can restrict our attention to surveillance objectives of one the following forms: , or , where .
Iii-E Multi-Agent Surveillance Synthesis Problem
A multi-agent surveillance game is a triple , where is a surveillance game structure, is a set of static sensors, and is a surveillance objective. A winning strategy for the sensors for is a joint strategy for the sensors in the corresponding belief-set game structure such that for every strategy for the target in it holds that . Analogously, a winning strategy for the target for is a strategy such that, for every strategy for the mobile sensors in , it holds that .
Problem statement: Given a multi-agent surveillance game , compute a joint strategy for the mobile sensors that is winning for the game .
In the remainder of the paper we show how to solve the multi-agent surveillance synthesis problem in a compositional manner. The key idea is to decompose the problem into a set of single-sensor surveillance games over smaller sets of locations, and solve each of these games separately.
Iv Distributed Surveillance Games
In the sequel we assume that in the surveillance game structure, i.e, all sensors and the target operate in the same state space. For the remainder of the paper, let be a multi-agent surveillance game structure defined over , and let be a set of static sensors. We define a state-space partition of size of the set of locations in a game structure to be a tuple of subsets of such that , and for .
Iv-a Surveillance Subgames
We now describe how, given a state-space partition , to construct a tuple of single-agent surveillance game structures that contains one surveillance subgame for each mobile sensor . Each subgame, is defined over the subset of locations . Since the target and sensors operate on the same state space we will have . Additionally, to each we add an auxiliary location that encapsulates all possible locations of the target that are outside of this subgame’s region, i.e., all locations in . We then model transitions leaving or entering as transitions to or from location respectively. We require that the initial location of sensor is in .
Formally, given a subset we define the subgame of corresponding to sensor as the tuple where:
is the set of states.
is the initial state, where , if , and otherwise.
The set consists of two types of transitions: the transitions in that originate and end in the subgame’s region are preserved as they are. Transitions of the target exiting or entering are replaced by transitions to and from location respectively, since represents all target locations outside of . Formally, for every pair of states and we have that if and only if there exists a transition for which the following conditions are satisfied:
if and , then and , that is, we have a transition internal for the region ;
if and , then and , that is, we have a transition exiting the region ;
if and , then and , that is, we have a transition entering the region ;
if and , then and , that is, we have a transition completely outside .
The visibility function in the subgame agrees with the visibility function of sensor in the original game when the target’s location is in the subgame’s region. Target locations outside of the region (summarized by location ) are invisible to the sensor in the subgame. Formally, when , and if .
In Figure (a)a, we have two subgames: for the green mobile sensor and for the blue one. The initial states in the subgames are , and . Recall that is an indicator state to represent that the target is not subgame . The transitions shown in Figure (b)b show that the target has the ability to leave and enter .
Note that in this construction, sensor is not able to leave the region of locations . Furthermore, all the information about the target’s behaviour outside of the subgame’s region is completely hidden from the mobile sensor controller, since all locations outside of are represented by the single location . In section IV-C, we discuss the local knowledge (belief) of sensor in the game structure .
Iv-B Static Sensors in Subgames
We assumed that all information about the target’s behaviour outside of subgame is completely hidden from sensor . Hence, sensor is only privy to static sensors that operate in the state space of the subgame , i.e, static sensors where . For simplicity of the presentation we assume that each static static sensor operates in exactly one region . Our results can easily be extended to the general case. We define to be the set of static sensors operating in the subgame .
Iv-C Local Beliefs in Surveillance Subgames
A surveillance subgame is a game structure with a single mobile sensor and some number of static sensors, and thus, is a special case of multi-agent surveillance game structure. With this, the definition of belief-set game structures from Section III-C directly applies to surveillance subgames.
In the belief-set game structure for a surveillance subgame with static sensors , the belief sets represent the local belief of sensor . More specifically, a belief set in is an element of , and can thus contain the auxiliary location. Intuitively, if is present in the sensor’s current belief, then the target could possibly be outside of the local set of locations , or if the belief is the singleton , then sensor knows for sure that the target is outside of its region. Additionally, if there is a triggered static sensor in the region, the sensor will know that the target must be in the state space of the static sensor and cannot be in the belief. Due to the definition of surveillance subgames in Section IV-A, the location must be in the belief of sensor whenever it is possible that the target is outside of its region. If , then at every given time must be in the belief set of at least one sensor (possibly several). We define the global interpretation of a belief set in , which is a set of locations in , as
Strategies of sensor in the belief-set game depend only on the sequence of states in this game, and thus, only on local information. Following the definitions in Section III-C, the outcome of a pair of given strategies and for the sensor and the target in is a sequence of states in , each of which is a pair consisting of a location of sensor and a belief-set for sensor in .
Iv-D Distributed Surveillance Synthesis Problem
Given a state-space partitioning and the corresponding tuple of subgames we will define a distributed surveillance strategy synthesis problem, which, intuitively, asks to synthesize strategies for the sensors in the individual belief subgames, such that together they guarantee the global surveillance objective. In this section we formalize this intuitive problem description. We first need to define what it means for the individual sensor strategies to jointly satisfy together a global requirement.
The surveillance requirements are defined in terms of the belief-states in , but strategies in the belief subgames are defined in terms of sequences of local belief states. Hence, we need to define a mapping of states of the form to elements of for each . Since, by definition, a strategy for sensor in the corresponding belief subgame guarantees that it remains in , we only need to define the mapping for states .
Formally, for a state in we define its projection on belief subgame as , where
The mapping extends to sequences of states in the usual way.
Intuitively, this mapping projects the joint knowledge of the sensors in onto the local belief of each sensor, where the sensors do not share their local beliefs with each other, that is, the sensors have no information about the target’s position outside of their own region. The global, shared belief of the sensors is formed by the combination of their local beliefs. More precisely, this is the intersection of the global interpretation of the local beliefs. Indeed, it is easy to see that the property holds.
Now we are ready to define the joint strategy of the sensors in obtained by executing together a given set of sensor strategies in the individual subgames. Let be strategies for the sensors in the belief subgames . We define the composition of , which is a joint strategy for the sensors in , as follows: for every sequence of states in , global belief and set of triggered sensors , we let
where for each .
Remark. If, for some , the projection is undefined, then is undefined. However, by the definition of each we are guaranteed that the projection is defined for every prefix consistent with .
Intuitively, the joint strategy makes decisions consistent with the choices of the individual strategies in the respective belief subgames.
Our goal is to synthesize a joint strategy that enforces a given surveillance property in the belief-set game by synthesizing individual strategies for all the sensors in the corresponding belief subgames. That is, we want to solve the following distributed surveillance synthesis problem.
Problem statement: Given a multi-agent surveillance game with sensors, and a state-space partition , compute strategies for the sensors in the belief subgames respectively, such that the composed strategy is a joint winning strategy for the sensors in the surveillance game .
Thus, in the distributed surveillance synthesis problem we have to compute strategies such that for every strategy for the target in it holds that . To this end, we have to provide local surveillance objectives for all the sensors, such that if all strategies are winning with respect to their local objectives, then their composition is winning with respect to the original surveillance objective. In this way we will reduce the multi-agent surveillance synthesis problem to single-agent surveillance problems over smaller sets of locations. This reduction is the subject of the next section.
V From Global to Local Specifications
In order to reduce the multi-agent surveillance synthesis problem for a given surveillance specification to solving a number of single-sensor surveillance subgames, we need to provide local surveillance objectives for the individual subgames. The local objectives should be such that by composing the strategies that are winning with respect to the local objectives we should obtain a strategy that is winning for the global surveillance objective. More precisely, we have to provide local surveillance specifications such that if for each it holds that is a winning strategy for the sensor in , then the strategy is a joint winning strategy for the sensors in .
Recall that the surveillance objective is of the form , or , or , where . We will provide translations for each of these types of specifications.
First, note that the belief sets in a belief subgame can contain the auxiliary location , which represents all locations in . Thus, when the local belief set contains , the size of the global belief set depends on the local beliefs of the other agents as well. We have to account for this in the translation from global into local surveillance objectives.
Consider the global safety surveillance specification in a network with two mobile sensors. In this case we can reduce the multi-agent surveillance problem to two single-agent surveillance games, each of which has as the local specification. To see why, consider the two possible cases of local belief set of sensor whose size is less than or equal to . If is not part of the belief set of sensor , then the target is definitely in the region of sensor , meaning that the global belief is of size less than or equal to , and hence smaller that . If, on the other hand, is part of the local belief of sensor , then the target can be in at most locations in . If at the same time we have that the local belief of sensor is of size at most , this would guarantee that the size of the global belief does not exceed . Local specifications , on the other hand do not imply the global specification. Indeed, if at a given point in time both sensors have local beliefs of size , each of which contains the corresponding location , the resulting global belief will be of size and thus violate the global specification.
Generalizing the observations made in this example, for any number of sensors and global safety surveillance objective , we define the local safety surveillance objective for each of the sensors, denoted , as where . Since and , we have .
Note that this translation is conservative, since if according to the belief of sensor the target could be outside its region, it should guarantee that the number of locations in its own region the target could be in is at most , even if the target can possibly be in only one of the other regions. This conservativeness is necessary to guarantee soundness in the absence of coordination between the sensors.
We now turn to liveness surveillance objectives. It is easy to see that each sensor guaranteeing a small enough local belief infinitely often is not enough to satisfy the global surveillance objective, since the local guarantees can happen in time-steps different for the different sensors.
Consider the global surveillance specification for a network with two sensors. Suppose is a strategy for the sensor in , which ensures that every even step the size of the local belief is , and every odd step the local belief contains
, and every odd step the local belief containsand its size is . Strategy in , is similar, but even and odd steps are interchanged: every even step the local belief contains and its size is , and every odd step the size of the local belief is . Thus, while and guarantee that their local belief is ”small enough” infinitely often, they do this at different steps.
We circumvent the problem illustrated in this example by requiring that each sensor satisfies the liveness guarantee on its own. For this, we have to consider two cases. First, if from some point on sensor always knows that the target is outside of its region, it has no obligation to satisfy the liveness surveillance guarantee. If, on the other hand, according to sensor ’s belief the target could be in infinitely often (note that this is true for at least one sensor), then it has to satisfy the corresponding liveness guarantee.
In order to capture this intuition, we need two additional types of surveillance predicates. First, we need to be able to express the negation of the property that the local belief of sensor is the singleton (which means that sensor knows that the target is outside ). For this, we introduce the predicate . Second, in order to express the local liveness guarantee, we need to be able to state that is not in (which means that sensor knows that the target is in its region). The predicate we introduce for this property is . Both predicates can be interpreted over belief sets similarly to and incorporated in LTL.
Formally, we define the local liveness specification for sensor denoted as
Note that the agent cannot trivially satisfy , since the belief set is defined precisely by it’s sequence of observations and is not under the agent’s direct control.
This translation is again conservative, since it would suffice that the liveness guarantee is satisfied by a single sensor. However, these can be different sensors for different behaviours of the target. Thus, we require that every sensor satisfies . This requires that if the target crosses from one region to another infinitely often, then both sensors have to satisfy the liveness surveillance objective.
Finally, for a global surveillance specification , the local surveillance specification for sensor is
Slightly abusing the notation, we denote with the local surveillance specification for sensor for any of the three types of global surveillance specifications.
The next theorem, which follows from the definition of the local specifications, states the soundness of the reduction.
Let be a multi-agent surveillance game with sensors, where is of the form , or , or , where . Let be a state-space partition. Suppose that are strategies for the sensors in the subgames respectively, such that for each sensor the strategy is winning in the surveillance game . Then, it holds that the composed strategy