Yann Busnel

Leonardo Querzoni

Roberto Baldoni

Marin Bertier

Analysis of Deterministic Tracking of Multiple Objects using a Binary Sensor Network

Keywords: F.2.2 [Theory of Computation]: Analysis of Algorithms and Problem Complexity-Nonnumerical Algorithms and Problems Algorithms, Theory Additional Key Words and Phrases: Binary Sensor Network, Distributed algorithm, Impossibility and Characterization, Passive Trajectory Tracking

Let consider a set of anonymous moving objects to be tracked in a binary sensor network. This paper studies the problem of associating deterministically a track revealed by the sensor network with the trajectory of an unique anonymous object, namely the Multiple Object Tracking and Identification (MOTI) problem. In our model, the network is represented by a sparse connected graph where each vertex represents a binary sensor and there is an edge between two sensors if an object can pass from one sensed region to another one without activating any other sensor. The difficulty of MOTI lies in the fact that the trajectories of two or more objects can be so close that the corresponding tracks on the sensor network can no longer be distinguished (track merging), thus confusing the deterministic association between an object trajectory and a track.

The paper presents several results. We first show that MOTI cannot be solved on a general graph of ideal binary sensors even by an omniscient external observer if all the objects can freely move on the graph. Then, we describe some restrictions that can be imposed a priori either on the graph, on the object movements or both, to make the MOTI problem always solvable. In the case of absence of an omniscient observer, we show how our results can lead to the definition of distributed algorithms that are able to detect when the system is in a state where MOTI becomes unsolvable.

INTRODUCTION

Context and motivations. "Tracking the movements of anonymous objects and associating each object trajectory with an unique identifier" is a basic problem in many applicative contexts such as surveillance [START_REF] Oh | Tracking on a graph[END_REF], rescue, traffic monitoring [START_REF] Bloisi | A distributed vision system for boat traffic monitoring in the venice grand canal[END_REF], pursuit evasion games, etc. Tracking objects with a sensor network is a challenging task. Potential inaccuracy of sensors (e.g. [START_REF] Aslam | Tracking a moving object with a binary sensor network[END_REF][START_REF] Lazos | Analytic evaluation of target detection in heterogeneous wireless sensor networks[END_REF]) and the complexity of the localization subsystem computability (e.g. [START_REF] Aspnes | On the computational complexity of sensor network localization[END_REF]) significantly complicate tracking initiation, maintenance and termination of object trajectories leading to false detection and missing observations. Even without considering false detections and missing observations, the problem of associating an unique identifier to a track corresponding to the trajectory of one of many objects is difficult due to the potential merging of tracks. Tracking a unique object moving among an ideal setting could appear trivial but following many anonymous objects becomes challenging, owing to that merging tracks may confuse the latter association if sensors do not have adequate capabilities [START_REF] Liu | Distributed group management for track initiation and maintenance in target localization applications[END_REF]]. In other words, two tracks may become so close to each other that they become indistinguishable, and then impossible to identify after splitting again. Deciding, after a track merging, what is a relevant association among multiple hypothesis is usually achieved by looking at the behaviors of tracks before the merging happened [START_REF] Liu | Distributed group management for track initiation and maintenance in target localization applications[END_REF][START_REF] Kulathumani | Trail: A distance-sensitive sensor network service for distributed object tracking[END_REF]]. In the following, we refer to this one-to-one mapping between tracks and object trajectories as the Multiple Object Tracking and Identification (MOTI) problem.

We investigate MOTI by using a binary sensor network, which means that each sensor reports only a binary value indicating if an object is in its sensing region or not. Focusing on such minimalist and simple devices is motivated by the fact that we want to study the essence of MOTI's solvability without looking at the powerfulness of sensors capabilities. As in [START_REF] Oh | Tracking on a graph[END_REF], in our model, the sensor network is represented by a sparse connected graph, namely the passage connectivity graph (PCG). Each vertex in this graph represents a binary sensor and there is an edge between two sensors u and v only if an object can pass from the sensing region of u to the one of v without activating any other remaining sensor.

Contributions. In this paper, we show that it is impossible to solve the MOTI problem in a generic graph. To make the impossibility as strong as possible, the impossibility is proved considering an omniscient observer that has a complete knowledge of the state of the graph and under ideal conditions for object tracking such as perfect binary sensors (i.e. no false detections or missing observations), ideal coverage of the sensing areas (i.e. disjoint sensing regions), so that at each instant of time one object activates only one sensor and each sensor is activated by at most one object.

We prove that the impossibility of solving MOTI is a structural problem that depends on the topology of the underlying PCG and on the number of moving objects. Then, we describe some restrictions that can be imposed a priori either on the graph, on the object movements, or on both, to make MOTI always solvable. More specifically, we show that if the passage connectivity graph is acyclic, MOTI can always be solved. Also, if the graph contains cycles with a length greater than ℓ, we prove that MOTI can be solved only if the maximum number of objects that can move concurrently is less than ℓ 2 . Finally, we propose a characterization of MOTI solvability based on the state of sensors belonging to cycles of the PCG. The interest of this characterization is twofold: (i) it leads to a computationally light algorithm run by the observer ensuring MOTI solvability and (ii) this characterization brings to the realization of distributed algorithms run by each sensor, thus removing the need of the omniscient observer. From this point of view, the choice of modeling the system with a PCG and reasoning on it is functional to the design of these solution as it let us easily translate theoretical results in algorithms.

Roadmap. Section 2 discusses some related works and Section 3 introduces the system model. Section 4 defines the Multiple Object Tracking and Identification (MOTI) problem and shows that this problem is impossible to solve in our setting. Section 5 gives • 3 two characterizations of MOTI solvability, which are used in Section 6 to introduce some promising classes of systems where MOTI can always be solved. However, previous characterizations are expensive to compute. Then, Section 7 presents a MOTI characterization involving only cycles in P CG. The algorithms derived by the latter MOTI characterization are presented in Section 8 (a centralized algorithm runs by the omniscient observer) and 9 (a fully distributed algorithm runs by each sensor) respectively. Finally, Section 10 concludes the paper.

RELATED WORK

Tracking mobile objects through sensors is useful in a large spectrum of applications [START_REF] Han | An algorithm for multiple object trajectory tracking[END_REF]. It is treated in the literature from various perspectives, but most of the works are concerned with the problem of correctly tracking one [START_REF] Aslam | Tracking a moving object with a binary sensor network[END_REF]] or more [START_REF] Singh | Tracking multiple targets using binary proximity sensors[END_REF]] objects in a network of binary sensors considering noise and false detections under various constraints (e.g. noise levels, power consumption [START_REF] Gui | Power conservation and quality of surveillance in target tracking sensor networks[END_REF], limited computational or network resources [START_REF] Liu | Distributed group management for track initiation and maintenance in target localization applications[END_REF], etc.). The problem of associating measurements from sensors to the appropriate tracks, especially when missing reports, unknown targets and false reports are present, has been tackled in the past [START_REF] Reid | An algorithm for tracking multiple targets[END_REF]] using approaches for extracting the most probable hypothesis from a set containing multiple hypotheses all compatible with the actual observations.

In our work, we take a more theoretical approach to the problem considering a setting characterized by a network of ideal sensors (no noise, no false detection, no limitation on communication) and show that, in the general case, it is impossible to correctly associate sensed tracks to moving objects. This result is a consequence of the possibility of track merging and splitting during the observation period [START_REF] Liu | Distributed group management for track initiation and maintenance in target localization applications[END_REF]]: once two tracks are merged due to the excessive proximity of two objects, it is impossible to deterministically maintain the identity of the two objects as soon as their tracks split.

Issues related to track merging and splitting are common to every setting where two or more objects can move freely. However, in order to provide the reader with proofs of our statements, in this paper, we limit the problem analysis to a specific environment where object movements are partially constrained, and that can be abstracted as a passage connectivity graph [START_REF] Oh | Tracking on a graph[END_REF]. Note that, beside the simplicity of this model, it still perfectly maps indoor applications like tracking the movements of people inside a building. Also our model includes passive object tracking [START_REF] Mao | ilight: device-free passive tracking by wireless sensor networks[END_REF][START_REF] Viani | Real-time indoor localization and tracking of passive targets by means of wireless sensor networks[END_REF]]. In such tracking, the object is assumed to be clean (and thus anonymous), i.e., there is no any equipment carried by the target and the tracking procedure is considered to be passive.

Recently, Crespi, Cybenko and Jiang [START_REF] Crespi | The theory of trackability with applications to sensor networks[END_REF]] proposed a theoretical analysis of trackability. They modeled the evolution of a nondeterministic automata whose state transitions can be observed. They explored the issue of how fast the number of possible tracks compatible with the observations grows. Their work shows that the worst case growth speed is either polynomial or exponential indicating a sort of phase transition in tracking accuracy for different settings. The problem of deciding if objects moving concurrently in an environment can be accurately tracked though a binary sensor network (i.e. the main problem attacked in this paper) can be seen as a special case of the problem investigated in [START_REF] Crespi | The theory of trackability with applications to sensor networks[END_REF]]: it should be checked if the set of hypothetical state evolutions that can be associated to the sequence of observations done through the sensors is always constituted by a single hypothesis; if this is the case, the MOTI problem can be solved. However, investigating this simplified scenario characterized by strong assumptions (i.e. perfect sensing devices, partially constrained movements, etc.) has a specific interest on its own, because it let us define constraints and algorithms (both centralized and distributed) that can be used a starting point to design and deploy systems where moving object can be deterministically tracked.

Last but not least, the study of tracking objects on binary sensors networks has gained a lot of attention in the very recent years. As an example, [START_REF] Wang | Distributed target tracking with imperfect binary sensor networks[END_REF]] studies the problem of object tracking in the presence of imperfect binary sensing and [START_REF] Shrivastava | Target tracking with binary proximity sensors[END_REF]] explores the limit of spatial resolution that can be achieved in tracking an objects within a two-dimensional field of binary proximity sensors.

SYSTEM MODEL

We consider a system composed of a set of generic objects moving in an environment where sensors can detect their presence. Such an environment can be modeled as a Passage Connectivity Graph P CG(V, E) where the set of vertices V represents binary sensors; it exists an edge e i,j ∈ E linking two vertices v i , v j ∈ V if and only if (iff ) it is possible for an object to move from the position where it is detected by sensor v i to the one where it is detected by sensor v j without activating, during the movement, any other sensor. We assume that, in the considered environment, movements are always possible in both directions. Therefore, the P CG is undirected. Moreover, we assume that there is always one single way to move between two positions: only an edge can connect two distinct vertices. For each vertex v i , a special edge e i,i exists in E representing the possibility for an object to remain in the same position.

The set of moving objects {o 1 , . . . , o x } is denoted by O. Time is represented as a discrete and infinite sequence T = [t 0 , t 1 , . . .] of instants starting at t 0 . At every time instant, each object o occupies a position represented by a vertex v i ∈ V . The position of an object o at a specific time instant t is given by the function loc : T × O → V that returns the corresponding vertex v i . When an object, positioned on a vertex v i , decides to move to a new position, it can choose as its destination any vertex v j such that e i,j ∈ E; the set of possible destinations is returned by the function adj : G × V → P(V ), where G is the set of all graphs. The movement of an object o at a specific time instant t is given by the function mov : T × O → E that returns the edge e i,j used for the movement where v i = loc t (o) and v j ∈ adj P CG (v i ).

We assume that, regardless of nodes positions and movements, the two following conditions always hold in our system: ∀t ∈ T, ∀o i , o j ∈ O, (i) loc t (o i ) = loc t (o j ) (i.e. two distinct objects cannot be located on the same vertex at the same time) and (ii) mov t (o i ) = mov t (o j ) (i.e. two distinct objects cannot move on the same edge at the same time). Without these constraints, obviously, the problem is trivially impossible. Note that making these assumptions hold in a real environment can be rather difficult due to the wide area covered by some sensors or to the impossibility of constraining the number of objects moving between the areas covered by different sensors; however, these consideration strengthen the results of impossibility showed in the next section.

Each object o ∈ O moves in the system describing a trajectory. The trajectory described by object o between t i , t j ∈ T (with j > i) is defined as

P ti,tj ,o = [v ti , . . . , v tj ] where v t k = loc t k (o), k ∈ [i, j].
For instance, Figure 1 shows 3 objects moving on a simple P CG. Their trajectories are presented in the caption. Note that an object can remain at the same place for a certain period of time, as o 3 between t 2 and t 3 . Given t i and t j , we define the global trajectory as the set containing all object trajectories. The global trajectory is denoted as P ti,tj = P ti,tj ,o o∈O or simply P if the time interval is precisely defined by the context. A specific global trajectory P ti,tj is an element of P ti,tj , the set containing all possible global trajectories described by the objects in O on P CG during the period [t i , t j ].

System State

The state of the system at time t is described by the state of each sensor (object detected or not) at that time. This state is represented as a vector of boolean values, one for each vertex in P CG. Definition 3.1 State Vector. A state vector at time t, denoted S t , is a vector of size |V | where:

∀v ∈ V, S t [v] = 1 if ∃ o ∈ O : loc t (o) = v 0 otherwise
For example, in Figure 1, we have

S t0 = [ 0 , 0 , 1 , 0 , 0 , 0 , 0 , 1 , 0 , 0 , 0 , 0 , 1 ]. ↑ ↑ ↑ ↑ ↑ ↑ ↑ ↑ ↑ ↑ ↑ ↑ ↑ A B C D E F G H I J K L M
In the following, we denote as S the set of all possible state vectors with respect to x objects in a given P CG. We obviously have |V |

x different state vectors.

The Observer

The system has an observer that is able to read, at any time t, the state vector S t . The aim of the observer is to identify objects and trace their trajectories over time. Given a state vector S t , the observer must identify a function tag to assign a unique identifier o ∈ O to each vertex v such that S t [v] = 1 (and a predefined value ⊥ to all the other vertices), with the only constraint that two vertices cannot share a same identifier (with the exception of ⊥). For instance, in Figure 1, as S t2 = [0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0] and O ⊂ N, we can have tag(S t2 ) = [⊥, 3, ⊥, ⊥, 2, ⊥, ⊥, ⊥, ⊥, ⊥, ⊥, 1, ⊥]. Each identifier represents an object identified by the observer. For the sake of convenience, we introduce the function loc : T × O → V that returns the vertex v that was tagged by o ∈ O at time t ∈ T . Given an object identified by the observer, and its corresponding tag o, we can define the observed trajectory between two time instants t i , t j as P ti,tj ,o = [v ti , . . . , v tj ] where

v t k = loc t k (o), k ∈ [i, j]
. Effectively, we have to introduce the observed global trajectory P ti,tj = P ti,tj ,o o∈O , corresponding to the set of all observed trajectories perceived by the observer. Obviously, P ti,tj belongs to P ti,tj .

THE PROBLEM OF IDENTIFYING OBJECTS AND

P ti,tj = P ti,tj
That means that the set of observed trajectories is exactly the same that the real ones. Given that trajectories (both real and observed) are a consequence of object locations, at a finer level of granularity, we have:

MOTI is solved iff ∀o ∈ O, ∃o ∈ O, ∀t ∈ [t i , t j ] : loc t (o) = loc t (o)
The difficulty of this problem comes from the fact that there could be situations in which the observer is not able to distinguish the trajectories of two or more objects. It is obvious that if |O| = 1, the problem is always solvable and trivial.

An impossibility result

In this section we show how the MOTI problem cannot be solved in the general case. The proof consists in a first theorem that states the conditions under which MOTI is not solvable, and second one where we prove that there exists at least one scenario where these conditions hold.

This first theorem formalizes an obvious intuition: if the observer can deduce from a single set of observations two different trajectories for a same object, it is impossible to deterministically decide which one is correct. THEOREM 4.1 MOTI UNSOLVABILITY. Given an interval of time [t i , t j ], a P CG(V, E), a set O of x objects, MOTI cannot be solved iff ∀tag, ∃P, P ′ ∈ P ti,tj : P = P ′ ∧ P = P ′ .

where P and P ′ are obtained by the observer using any function tag from real global trajectories P and P ′ .

PROOF. Let us consider an interval of time [t i , t j ], a P CG(V, E) and a set O of x objects.

• 7 -Given any tag function, assume that (1) ∃P, P ′ ∈ P ti,tj : P = P ′ ∧ P = P ′ and

(2) MOTI can be solved. Given that MOTI can be solved we have P = P and that P ′ = P ′ (cf. MOTI definition in section 4). But, we have P = P ′ and P = P ′ . Therefore, there is a contradiction. -Let prove now that if MOTI cannot be solved =⇒ ∀tag, ∃P, P ′ ∈ P ti,tj : P = P ′ ∧ P = P ′ . Let prove the contrapositive (i.e. modus tollens) of this proposition. Consider ∃tag, ∀P, P ′ ∈ P ti,tj : P = P ′ =⇒ P = P ′ (P = P ′ ∨ P = P ′ ).

Let us call map : P ti,tj → P ti,tj a function which associates the real trajectory to the observed one. Each bijective map function verifies the following expression: ∀P, P ′ ∈ P ti,tj : P = P ′ =⇒ map(P ) = map(P ′ ) =⇒ P = P ′ as map(•) corresponds to the observed trajectories. Let map be the identity function. We have: ∀P ∈ P ti,tj : P = map(P ) = P . Then, by definition of Section 4, MOTI can be solved using this specific tag function. Thus, by contrapositive, we have: MOTI cannot be solved =⇒ ∀tag, ∃P, P ′ ∈ P ti,tj : P = P ′ ∧ P = P ′ .

We then obtain the equivalence, i.e. a characterization of the MOTI unsolvability.

COROLLARY 4.2 MOTI SOLVABILITY. Given an interval of time [t i , t j ], a P CG(V, E), a set O of x objects and a tag function. MOTI can be solved if, and only if, ∀P, P ′ ∈ P ti,tj :

P = P ′ =⇒ P = P ′ .
Consequently, it is impossible to solve MOTI if, and only if, there exist at least two global trajectories which respect the condition of Theorem 4.1. Therefore, we can state that: THEOREM 4.3 MOTI IMPOSSIBILITY. Given the system model presented in Section 3, MOTI cannot be solved.

PROOF. Consider a 4 vertex P CG with a 4 edge loop around its vertices, as shown in Figure 2.a. Consider two objects moving in this P CG and a time interval constituted by two consecutive time instants [t 0 , t 1 ] with t 1 = t 0 + 1. Consider the two global trajectories P, P ′ ∈ P t0,t1 , presented in Figure 2.b and 2.c. They are defined as:

       P = [A , B] [D , C] P ′ = [A , C] [D , B]
Obviously, we have P = P ′ . According to the system model and the observer capabilities, the information known by the observer for both case P and P ′ , is presented in Figure 2.d. We assume that t 0 is the initial time. Then, the observer does not have any other information available about the system than the two following state vectors (which are the same for both P and P ′ ):

S t0 = 1, 0, 0, 1 and S t1 = 0, 1, 1, 0
As the relation tag is a function (a single output for a given input element), it exists a unique tagging for a state, according to the corresponding state vector and previous state available. Thus, assume that: According to tag(S t0 ) and S t1 , only two values are possible for tag(S t1 ):

tag(S t0 ) = 1, ⊥, ⊥, 2 .
(1) tag(S t1 ) = ⊥, 1, 2, ⊥ or (2) tag(S t1 ) = ⊥, 2, 1, ⊥ .
For each of these cases, tag(S t1 ) is the same for the observation of P and P ′ . So, given a function tag, P = P ′ . Then, due to Theorem 4.1, MOTI cannot be solved.

In order to better understand this result, let's take a closer look at each case:

Case (1). In this case, the observed global trajectory computed by the observer is:

P = P ′ = [A , B] [D , C] .
Then, we have P = P = P ′ = P ′ and MOTI is not solvable.

Case (2)

. By symmetry, in this case, the observed global trajectory computed by the observer is:

P = P ′ = [A , C] [D , B] .
Then, we have P ′ = P ′ = P = P and MOTI is not solvable.

So, it exists at least one case in which MOTI cannot be solved.

MOTI SOLVABILITY

We have proved that, in the general case, MOTI cannot be solved. Yet, we can identify some constraints that can be added to the system in order to solve it. Before delving into the details about how the system model can be constrained to make MOTI solvable, we need to introduce additional notations.

• 9

Characterization of safe/unsafe states and movements

Given an object o and the trajectory it describes on the P CG as time goes, we can identify every single movement.

Definition 5.1 Movement. Let o ∈ O be an object moving in the system represented by P CG(V, E). For each time instant t ∈ T , we define its movement as m t,o = P t,t+1,o .

Definition 5.2 Movement Set. Consider a system represented by P CG(V, E) where objects belonging to O can move. For each time instant t ∈ T , we define the movement set as M t = P t,t+1 .

The movement set is defined, for each time instant t, as the set of all movements done by objects; therefore, it represents how the system "evolves" right after the specific time t.

If we now consider the system state at a specific time t, we can identify all the possible movements that objects are able to do. Each possible combination of these movements corresponds to a different movement set. All these movement sets are defined on the basis of the position of objects on the graph, i.e. given a state vector, we can define all the possible movements. From this point of view, movement sets are not necessarily tied to time, as they can be considered as the sets of possible movements that objects can do if, at a certain time, they are located on a specific subset of vertices. This idea leads us to the definition of the State Graph, which is a graph representing possible system states (in terms of state vectors) and possible movements sets linking them.

Definition 5.3 State Graph. Let P CG(V, E) be a graph representing the environment where x objects can move. The corresponding state graph is defined as SG(S, M), where S is the set of all possible state vectors and M is the set of all possible movement sets.

Figure 3 shows an instance of a state graph, depicted on the right side, when considering two moving objects and the 4 vertex P CG introduced above, depicted on the left side. In this example, each arrow corresponds to a possible movement. For instance, from S 5 to S 4 , we have only one possible movement :

M = {[B, D]; [D, C]} .
Now we can define which edges and which vertices of the state graph should be considered as unsafe with respect to the solvability of MOTI.

Definition 5.4 Unsafe Movement. Consider a system represented by P CG(V, E) where objects belonging to O can move, and the corresponding state graph SG(S, M). Consider two states S, S ′ ∈ S such that it exists a movement set M ∈ M that links these two states

(S M -→ S ′ ). M is unsafe iff ∃M ′ ∈ M such that S M ′ --→ S ′ and M = M ′ .
We consider unsafe all movement sets linking two system states that are linked by at least two movement sets. The idea behind this definition is that an observer can not distinguish which movement set has really occurred between all the possible unsafe movement sets linking the same system states (because the trajectories it observes are only built using system states). The presence of unsafe movements in a state graph makes MOTI problem impossible to solve. Considering again the state graph depicted in Figure 3, states S 2 and S 3 are both unsafe because there are two distinct edges (two unsafe movement sets) linking them (bold arrows). All the other states (and, by the way, all the other movements sets) are safe.

Characterizing MOTI solvability

On the basis of these definitions, we revise Theorem 4.2 and propose two different definitions of MOTI solvability. First, we assume that the global trajectory is known (e.g. when analyzing the behaviour of the system a posteriori).

THEOREM 5.6 P -SOLVABILITY. Let SG(S, M) the state graph defined over a P CG(V, E) representing the system where objects in O can move. Consider a specific trajectory P ∈ P ti,tj : MOTI can be solved iff ∀t ∈ [t i , t j-1 ], M t is safe.

PROOF. Consider a specific trajectory P ∈ P ti,tj .

-Assume that ∃t ∈ [t i , t j-1 ] such that M t is unsafe. Let us call P * = P t,t+1 the subtrajectory of the considered P ti,tj such that M t = P * . Due to Definition 5.4, it exists at least one different unsafe movement M ′ in M between the two same system states S, S ′ such that M ′ = P ′ * . Obviously, P * = P ′ * but they share the same initial and final state vectors S t and S t+1 . Given that the relation tag available to the observer is a function, it exists a unique tagging for these states. Then, we have:

∃P * , P ′ * ∈ P t,t+1 : P * = P ′ * ∧ P * = P ′ * .
Therefore, due to Theorem 4.1, MOTI is unsolvable for P * and P ′ * . Therefore, given that P * is a sub-trajectory of P ti,tj , MOTI is unsolvable for P ti,tj .

-Assume here that ∀t ∈ [t i , t j-1 ], M t is safe. Then, we have:

∀t ∈ [t i , t j-1 ], ∄ M = M t such that S t M -→ S t+1 . Then, ∀t ∈ [t i , t j-1 ], ∃!P ∈ P t,t+1 from S t to S t+1 and, as • 11
it is unique, this P is the sub-trajectory between time t and t + 1 of the considered P ti,tj . So, ∀P ′ ∈ P t,t+1 such that P = P ′ , the initial (or respectively the final) system state of P ′ is not equal to the initial (or respectively the final) system state of P . Then, consider a bijection function map as introduced in the proof of Theorem 4.1. We have: ∀P ′ ∈ P t,t+1 : P = P ′ =⇒ map(P ) = map(P ′ ). If map is the identity function, we have: ∀P ′ ∈ P t,t+1 : P = P ′ =⇒ P = P ′ . Therefore, due to Corollary 4.2 MOTI can be solved.

Even though characterizing MOTI solvability with respect to a specific global trajectory is useful for all those systems where we want to decide at any point of time if MOTI is solvable or not, it is also possible to define a set of cases where MOTI is always solvable. This new characterization generalizes Theorem 5.6 with all possible trajectories that can occur in the system: THEOREM 5.7 P-SOLVABILITY. Let SG(S, M) the state graph defined over a graph P CG(V, E) representing the system where objects in O can move. ∀P ∈ P ti,tj : MOTI can be solved iff ∀S ∈ S, S is safe.

PROOF. Assume that ∀P ∈ P ti,tj MOTI can be solved. Then, ∀P ∈ P ti,tj , ∀t ∈ [t i , t j-1 ] : M t is safe (Theorem 5.6) and ∀P ∈ P ti,tj , ∀t ∈ [t i , t j-1 ] : S t is safe (Definition 5.5). Given that each system state can occur as an initial state of a trajectory, we have:

∀S ∈ S, ∃P ∈ P ti,tj : S ti = S.
Then, given that all system states are safe for all possible trajectories, we have that ∀S ∈ S, S is safe.

Assume now that ∀S ∈ S, S is safe. Due to Definition 5.5, we have that ∀M ∈ M, M is safe. It follows that ∀P ∈ P ti,tj , ∀t ∈ [t i , t j-1 ], M is safe. Therefore due to Theorem 5.6, MOTI can be solved.

We then obtain two definitions of MOTI solvability, according to the granularity required by the context. The latter can be very different depending to the knowledge of the designer and the aim of the observation (a priori or online treatment).

Both are used in the following for characterizing MOTI solvability with a specific or generic point of view.

A SUFFICIENT CONDITION FOR MAKING MOTI P-SOLVABLE

In this section, we show how MOTI can be solved by adding some specific constraints on the system model. More specifically, we show how the problem becomes easily solvable if we assume that object movements are limited in some way.

As we previously explained, the state graph associated to a system may present one or more unsafe states that make MOTI unsolvable. One way to avoid the presence of unsafe states in the state graph, is to remove some of the unsafe movements sets such that the remaining movements sets are all safe. From a practical point of view, this means limiting object movements in the environment, modifying the environment itself or constraining their actions. Let think about a traffic control application where vehicles can move from one road to another through barriers, this can be realized simply by closing temporary some barriers in case of huge growth of traffic density. Therefore, that means deleting the corresponding edges between two vertices of P CG and modifying accordingly the state graph.

Basically, the only cause of the MOTI non solvability in a system is the presence of cycles in the graph (cf. Corollary 6.2): when two or more objects move inside a cycle, it might be impossible to distinguish their trajectory based on the sole observation of the state vectors. This problem can be avoided by limiting the number of objects in O that can move concurrently below a specific constant k, which strictly depends from some characteristics of the P CG. Note that if k = 1, MOTI is trivially always solvable because this scenario is equivalent to the one where a single moving object is present. In this case, we can guarantee that MOTI is solvable for all the possible trajectories P such that at most k objects move concurrently at each time unit. The set of all these trajectories is a subset of P and will be denoted as P k . THEOREM 6.1. Let k ≤ |O| be the maximum number of objects that can move concurrently, ℓ > 1 be an integer and P CG(V, E) be a graph which does not contain cycles of length 1 < l < ℓ. ∀P ∈ P k : MOTI is P -solvable iff ℓ 2 > k. PROOF. We first prove that if k < ℓ 2 ⇒ ∀P ∈ P k , P does not contain any unsafe movement. The proof is done by induction on the number n of objects moving concurrently in the system at each step. In the following, given S and S ′ two state vectors, we refer to diff (S, S ′ ) to denote the number of vertices in P CG whose state changes between S and S ′ . Note that diff (S, S ′ ) is always an even number because for each object that moves, two vertices change their state in the state vector. Base step on n. Consider the State Graph construction algorithm reported in Appendix A.1. At the first iterative step of that algorithm, edges labeled with the movement of a single object are added to the edge-free state graph, linking all the possible couples of state vectors S, S ′ such that diff (S, S ′ ) = 2 and it exists an edge in P CG linking the two vertices that changed their state. For each of these couples (S, S ′ ), a single edge is added as only one object in the system can do the movement associated to the two vertices whose state changes between S and S ′ . Therefore, for a system where only one object at a time can move (i.e. n = 1), the resulting state graph does not contain any unsafe movements. Induction hypothesis. Assume that if n objects move concurrently, none of the possible trajectories P ∈ P n contains an unsafe movement. Induction step on n. Now, consider the case where n + 1 objects move concurrently. We want to show that, apart from this change, no unsafe movement is added to SG. More specifically, we want to prove that ∀S, S ′ ∈ SG such that 2 ≤diff (S, S ′ ) ≤ 2(n + 1), if we can add an edge in SG between S and S ′ labelled with n + 1 concurrent movements, then there cannot exist another edge between them labelled with n + 1 or less movements.

Let us first consider the case where diff (S, S ′ ) = 2. Assume that the two vertices changing their state between S and S ′ are labelled v 1 and v n+2 . An edge labelled with n + 1 movements can be added in SG between S and S ′ only if it exists in P CG the path p = v 1 , v 2 , . . . , v n+1 , v n+2 and ∀v ∈ {v 1 , . . . , v n+1 }, S[v] = 1. Now, we show that the only possible movement bringing the system from S to S ′ is the one where each object located in v i , with i ∈ [1, n + 1], moves to v i+1 . Assume, without loss of generality, that there is another possible movement that does not involve objects located on vertices v 2 , . . . , v n+1 . Figure 4 represents this case where the object located on v 1 must move to a different subgraph P CG A of P CG and an object located on subgraph P CG B must move to node v n+2 . If the only path connecting vertices in P CG A with vertices in P CG B is p (it does not exist a link p ′ as in Figure 4), then |{v ∈ P CG A :

• 13 v p PCG A PCG B p' 1 v 2 v n+1 v n+2
S ′ [v] = 1}| > |{v ∈ P CG A : S[v] = 1}| (and respectively, |{v ∈ P CG B : S ′ [v] = 1}| < |{v ∈ P CG B : S[v] = 1}|). This implies that ∃v ∈ P CG A ∪ P CG B : S[v] = S ′ [v] ⇒diff (S, S ′ ) > 2,
which is impossible due to our initial hypothesis. On the contrary, if there is a path p ′ = p connecting P CG A to P CG B , then p is part of a cycle c ⊂ G. The length of c is, by assumption, at least ℓ. In order to have diff (S, S ′ ) = 2, in S, there must be an object located on all vertices in c but v n+2 and all the objects located on these vertices, with the exception of those located on v 2 , . . . , v n+1 , must be moved (otherwise diff (S, S ′ ) > 2). But this means that m (≥ ℓn) objects will move concurrently. Given that ℓ 2 > k ≥ n + 1, we have m > 2(n + 1)n > n + 1, i.e. every other edges connecting S to S ′ in SG must be labelled with more than n + 1 movements. Now, consider the case where diff (S, S ′ ) = 2(x + 1) with x ≤ n. In this case, there are n + 1 distinct objects moving on x + 1 distinct paths, each characterized by the presence of an object on each vertex but the last one (as p in Figure 4). The same reasoning shown for the previous case can be applied to every single path, considering that each of these paths contains strictly less than n + 1 objects.

Secondly, we prove by contradiction that if ∀P ∈ P k , MOTI is P -solvable ⇒ ℓ 2 > k. Assume for the moment that k ≥ ℓ 2 . Consider the smallest cycle c in P CG constituted by vertices v 1 , . . . , v ℓ . Now consider, without loss of generality, a state vector S where ∀i ∈ {2

• k -1|k ∈ [1, ℓ 2 ]} : S[v i ] = 1 and ∀i ∈ {2 • k|k ∈ [1, ℓ 2 ]} : S[v i ] = 0. Consider also the state vector S ′ that is identical to S but where ∀i ∈ {2 • k -1|k ∈ [1, ℓ 2 ]} : S[v i ] = 0 and ∀i ∈ {2 • k|k ∈ [1, ℓ 2 ]} : S[v i ] = 1 (Note that, if ℓ is odd then S ′ [v ℓ ]
remains unchanged and equals to 1). Then the states of all vertices -but the last in case of ℓ odd -indexed from 1 to ℓ are inverted. Such two state vectors are in SG with certainty because we are assuming that k ≥ ℓ 2 . Now consider the following movements

M = {[v i , v i+1 mod ℓ ]} i∈{2•k-1|k∈[1,⌊ ℓ 2 ⌋]} and M ′ = {[v i , v i-1 mod ℓ ]} i∈{2•k-1|k∈[1,⌈ ℓ 2 ⌉]} .
Both movements link S to S ′ in SG and are labeled with lower or equals concurrent moves than k. Therefore, at least an unsafe movement exists. This is in contradiction with the initial assumption that ∀P ∈ P k , MOTI is Psolvable.

In a nutshell, there are two possible methods to guarantee that the conditions at the basis of Theorem 6.1 always hold. The first method requires to choose, as the P CG, a topology characterized by cycles of length strictly larger than 2 • x. As a consequence, MOTI is P-solvable in any system characterized by an acyclic graph as presented in the following Corollary 6.2. The second method requires to limit the number of objects that can move concurrently in the system. COROLLARY 6.2. MOTI is P-solvable in any system characterized by a P CG(V, E) that is acyclic. PROOF. We can consider P CG as a graph with a cycle of infinite length. Due to Theorem 6.1, MOTI is P-solvable as long as no more than an infinite number of objects move concurrently in the system. Given that O is finite, the P-solvability is always guaranteed.

FROM REASONING ON STATE GRAPH TO REASONING ON P CG

Previous characterizations exploited the notion of state graph, however getting the full knowledge of the entire state graph can be computationally very expensive 1 . Moreover, calculating the state graph needs the complete knowledge of the system. At contrary, reasoning directly on the P CG opens the way to distributed solutions that relies only on local knowledge (cf. Section 9). Therefore we need to introduce a new MOTI characterization based on a more tractable data structure, namely the P CG.

First, this section introduces (Section 7.1) a characterization of an unsafe state based both on cycles present in the P CG and on the placement of objects on top of cycle's vertices (Theorem 7.1). This theorem leads to an interesting corollary that can be practically used as a sufficient condition for defining if a state is safe, i.e. if each cycle of the P CG contains at least two adjacent vertices sensing no objects. This practical condition is used in Section 8.2 to design a centralized algorithm, run by the observer, to circumvent MOTI impossibility and in Section 9 to derive a distributed algorithm to detect unsafe states.

Secondly, this section presents (Section 7.2) a characterization of unsafe movements based both on the presence of cycles in the P CG and on the placement of objects in cycle's vertices (Theorem 7.5). This theorem is used in Section 8.2 to derive an algorithm, run by the observer, that after detecting an unsafe state, can help the system to avoid an unsafe movement by constraining the movements of k -1 objects. Notations. Hereafter, we denote as c a generic cycle in a P CG and ℓ c its length in terms of edges. Also, when needed, we consider that the vertices of a cycle c are labeled following a clockwise order. As an example, Figure 5 depicts a cycle with ℓ c = 13 where nodes are labelled from v 1 to v ℓc = v 13 . Moreover, the notation c ⊆ G means c is a cycle in the graph G.

Finally we introduce the notion of unoccupied vertices'set of a cycle c, for a given state vector S, denoted ξ c (S). This set is defined as follows: S t is unsafe ⇐⇒ (∃c

ξ c (S) = {i ∈ [1, ℓ c ]|S[v i ] = 0}
⊆ P CG, ∀v ∈ c, S t [v] = 0 ⇒ ∀v ′ ∈ Adj c (v), S t [v ′ ] = 1)
PROOF. OF THEOREM 7.1: (⇐=) Assume that the ℓ c vertices of cycle c are numbered from v 1 to v ℓc in the clockwise order (see Figure 6). For simplicity, we present first the case where |ξ c (S t )| = 1, then the generic one where |ξ c (S t )| = l. Fig. 6. In this scenario with a half occupied ℓc vertex cycle, in the absence of a way to identify objects, it is impossible to discern between the two movements (dashed vs. solid).

• Yann Busnel et al.

|ξ c (S t )| = 1: Then, ∃! k ∈ [1, ℓ c ] such that S t [v k ] = 0.
Therefore, we have the following two states S t and S t+1 :

k k + 1 ↓ ↓ S t = [1 • • • 1 0 1 1 • • • 1] and S t+1 = [1 • • • 1 1 0 1 • • • 1]
Then there exist two movement sets M, M ′ ∈ P t,t+1 such that: -M and M ′ contain the same set of movements for all the objects that are not located in c; -M contains the movement of a single object located in c that move counterclockwise from v k+1 to v k ; -M ′ contains the movements of all objects located in c that move clockwise. Then there exist at least two distinct movements from S t to S t+1 . These movements are unsafe by Definition 5.4 and S t is consequently unsafe by Definition 5.5. |ξ c (S t )| = l with l ≤ ℓc 2 . This case is a generalization of the previous one. Figure 6 shows the extreme case for odd and even cases that still satisfy the theorem hypotheses.

In S t , we have ∀i ∈ ξ c , S t [i] = 0. Let consider S t+1 such that ∀i ∈ [2, ℓ c ], S t+1 [v i ] = S t [v i-1 ] and S t+1 [v 1 ] = S t [v ℓc ]. It follows that ξ c (S t+1 ) = {i + 1 mod ℓ c |i ∈ ξ c (S)}.
Then, there exist two movement sets M, M ′ ∈ P t,t+1 such that : -M and M ′ contain the same set of movements for all the objects that are not located in c; -M contains the movements of |ξ c (S t )| objects located in c that move counterclockwise (corresponding to objects located on v i+1 , ∀i ∈ ξ c (S t )); -M ′ contains the movements of all objects located in c that move clockwise. Then there exist at least two distinct movement sets from S t to S t+1 . These movements are unsafe by Definition 5.4 and S t is consequently unsafe by Definition 5.5.

(=⇒) Let's prove the contrapositive of the theorem claim.

(∀c

⊆ P CG, ∃v ∈ c, S t [v] = 0 ∧ ∃v ′ ∈ Adj c (v), S t [v ′ ] = 0) ⇒ S t is safe which is equivalent to (∀c ⊆ P CG, ∃v ∈ c, ∃v ′ ∈ Adj c (v), S t [v] = S t [v ′ ] = 0) ⇒ S t
is safe Therefore, assume to have a state S t such that the following predicate (a) is true:

∀c ⊆ P CG, ∃v ∈ c, ∃v ′ ∈ Adj c (v), S t [v] = S t [v ′ ] = 0 (a)
We want to show that all movements starting form S t are safe. We have to recall here that, as stated in the system model, an object cannot move in one single step further than an adjacent vertex of its current location. Consider a portion of cycle c, which by hypothesis respects the assumption (a), represented on the top of Figure 7. Starting from this state, only four possible evolutions of these two vertices can happen, presented from left to right on the bottom part of the same figure. Let's consider each of these cases separately.

Case 1. Consider the system evolves from S t to case 1 of S t+1 as depicted in Figure 7. Neither v i and v j are occupied. According to the system model, no object can move through both these two vertices between t and t + 1. Then, the edge connecting these vertices in the P CG can be considered as inexistent between t and t + 1, as far as object movements are concerned. Thus, the cycle c can be considered as an acyclic path for this specific time step. Case 2.a. Consider the system evolves from S t to case 2.a of S t+1 as depicted in Figure 7. v i is occupied. Given that an object cannot pass through several vertices with a single movement, the object located on v i necessarily arrived from the left edge of the picture. Then, the edge connecting these vertices in the P CG can be considered, again, as inexistent between t and t + 1, as far as object movements are concerned. Thus, the cycle c can be considered as an acyclic path for this specific time step.

Case 2.b. This case is the same as case 2.a with inverting v i and v j . Then, the object located on v j necessarily arrived from the right edge of the picture.

Case 3. Consider the system evolves from S t to case 3 of S t+1 as depicted in Figure 7. Both v i and v j are occupied. The object located on v i at time t + 1 arrived from the left edge of the picture while the one located on v j arrived from the right edge of the picture. This is the only possibility given that, in a single movement, two objects cannot traverse a same edge. Then, the edge connecting these vertices in the P CG can be considered, again, as inexistent between t and t + 1, as far as object movements are concerned. Thus, the cycle c can be considered as an acyclic path for this specific time step.

This last reasoning can be applied on all the cycle of P CG as the assumption (a) considers any cycle of the P CG. Then, all cycles can be considered as acyclic between t and t + 1, as far as object movements are concerned. Therefore, according to Corollary 6.2, S is safe.

The previous theorem implies that if each unoccupied vertex of a cycle in P CG is surrounded by occupied vertices, then it exists an unsafe movement starting from this state. For instance, in Figure 5, any element of the set of unoccupied vertices (i.e. {v 1 , v 7 , v 10 }) is surrounded by occupied vertices. Further, we can cite at least two unsafe movements:

P =        [v 2 , v 1 ] [v 3 , v 2 ] [v 8 , v 7 ] [v 11 , v 10 ]        and P ′ =                            [v 3 , v 4 ] [v 4 , v 5 ] [v 5 , v 6 ] [v 6 , v 7 ] [v 8 , v 9 ] [v 9 , v 10 ] [v 11 , v 12 ] [v 12 , v 13 ] [v 13 , v 1 ]                           
This observation brings to the following characterization of a safe state: COROLLARY 7.2. Given a state vector S, S is safe iff in each cycle c of P CG there is at least two adjacent vertices that do not host objects.

PROOF. The proof derives directly from the negation of the claim of Theorem 7.1 i.e., S is safe

⇔ ∀c ∈ P CG, ∃v ∈ V such that S[v] = 0 ∧ ∃v ′ ∈ Adj c (v), S[v ′ ] = 0.
Therefore, if we consider a P CG including the cycle depicted in Figure 5, the state of the P CG is unsafe.

Unsafe Movement Characterization based on P CG

MOTI becomes unsolvable if an unsafe movement leads the system into an unsafe state. Therefore, this section studies the problem of characterizing unsafe movements with respect to P CG when the system is in a certain state S. Thanks to Theorem 7.5, the problem of safe and unsafe movements can be studied only considering cycles in P CG.

We first need to formalize in a cycle the length of the sequence of adjacent vertices that host objects with respect to the position of a given vertex v in the same sequence. Therefore, for each direction of the cycle c with respect to v we have two possibly different values. Formally, we have:

Definition 7.3 Clockwise Object Sequence.
The clockwise object sequence from v on a cycle c at time t, denoted µ -1 c,t (v), is the length of the clockwise sequence of occupied vertices in c, starting from v (no included). Definition 7.4 Counterclockwise Object Sequence.

The counterclockwise object sequence from v on a cycle c at time t, denoted µ +1 c,t (v), is the length of the counterclockwise sequence of occupied vertices in c, starting from v (not included).

As an example in Figure 5, if we consider the cycle c and vertex v 1 at time t, µ +1 c,t (v 1 ) is equal to 3 and µ -1 c,t (v 1 ) to 5. Before getting into the formal theorem characterizing when a movement is safe or not, for clarity of the reader, we provide an intuition, an informal explanation of the statement and an introductory example. Theorem 7.5's intuition. The characterization of safe and unsafe object movements in a cycle c depends on the rotation of objects in c. A movement that brings the system from S t to S t+1 is safe if the movement is constituted by some objects that move clockwise and some other moving counterclockwise. The different direction of object movements makes the whole movement unique (i.e., it cannot exist another movement that brings the system in the same state S t+1 ). On the contrary, if the movement is formed by all objects moving in the same direction (either clockwise or counterclockwise) then this one is unsafe (because S t+1 could be reached also moving the objects in the opposite direction). Figure 8 shows an example of safe movement from S t to S t+1 where some objects move clockwise and some other move counterclockwise. Figure 9 shows an example of unsafe movements where S t+1 can be reached from S t through two distinct movement sets. The first one moves objects clockwise, the second one moves objects counterclockwise. Theorem 7.5's informal explanation of the statement. To check if all objects move along the same direction or not, we observe how unoccupied vertices "virtually" move between two consecutive states S t and S t+1 inside a cycle. These "virtual" movements are due to the real movements done by objects in c. For example, Figure 8 shows that the "virtual" movement of the unoccupied vertex v 1 at S t into v 2 at S t+1 is due to the real movement of the object hosted by v 2 at S t into v 1 at S t+1 . The "virtual" movement of v 7 at S t in v 5 at S t+1 is due to the real movement of the objects hosted by both v 5 and v 6 in v 6 and v 7 respectively.

Combining the notion of virtual movements and the one of clockwise/counterclockwise object sequences, we notice that a movement is unsafe if the distance between each unoccupied vertex in S t and S t+1 is lesser than or equal to either its counterclockwise object sequence or its clockwise object sequence at time t. A movement is safe if the distance between at least one unoccupied vertex v in S t and S t+1 (due to the v's virtual movement) is greater than either v's counterclockwise object sequence or v's clockwise object sequence at time t. The existence of such v is actually the proof that some objects moved clockwise and some other counterclockwise. Introductory example. Figure 8 shows a state that can be reached from the state of Figure 5 due to a safe movement. If we consider the informal explanation of the theorem and the two object sequences for each unoccupied vertex depicted in Figure 8, we have:

(i) Clockwise: v 1 virtually moves to v 5 , v 7 to v 8 and v 10 to v 2 . Then, concerning v 1 , we have that its virtual movement in the cycle, from t to t + 1, is of (5 -1) positions while µ -1 c,t (v 1 ) is equal to 5. On v 7 , we have (8 -7) ≤ µ -1 c,t (v 7 ) = 2 and on v 10 , we have (2 -10 mod 13) > µ -1 c,t (v 10 ) = 3. Therefore, it exists at least one unoccupied vertex (i.e, v 10 ) which has virtually moved further than its clockwise object sequence.

(ii) Counterclockwise: v 1 virtually moves to v 8 , v 7 to v 2 and v 10 to v 5 . Then, concerning v 1 , we have (1 -8 mod 13)µ +1 c,t (v 1 ) = 3. On v 10 , we have (10 -5) > µ +1 c,t (v 10 ) = 2 and on v 7 , we have (7 -2) ≥ µ +1 c,t (v 7 ) = 5. Therefore, it exists at least one unoccupied vertex (here, v 1 and v 10 ) which has virtually moved further than its counterclockwise object sequence. Therefore, following the theorem informal explanation, the movement is safe.

Consider now the unsafe movements shown in Figure 9 that bring to the same state S t+1 . We observe that, clockwise, v 1 virtually moves to v 4 , v 10 to v 13 and v 7 to v 9 . Then, regarding v 1 , (4 -1) ≤ µ -1 c,t (v 1 ) = 5, regarding v 7 , (9 -7) ≤ µ -1 c,t (v 7 ) = 2 and regarding v 10 , (13 -10) ≤ µ -1 c,t (v 10 ) = 3. Thus, all unoccupied vertices have moved lesser than their respective clockwise object sequences. Then, the condition of the theorem is verified, and the movement is unsafe.

More formally:

(∃k ∈ {-1, 1}, ∀v i ∈ c, S t [v i ] = 0 ⇒ ∃j ∈ [1, µ k c,t (v i )], S t+1 [v i+k•j mod ℓc ] = 0
). Let J k c,t be the vector containing, for each empty vertex v i of c, the value of j picked in [1, µ k c,t (v i )] if S t [v i ] = 0, and ⊥ otherwise. Consider the following movement sets M, M ′ ∈ P t,t+1 :

-M and M ′ contain the same set of movements for all the objects that are not located in c; Then, M and M ′ lead to the same set ξ c (S t+1 ). Thus, M and M ′ correspond to two different movements from S t to S t+1 . So, it exists at least one movement set (either M or M ′ ), different from M t , between S t and S t+1 . Then, by Definition 5.4, M t is unsafe.

-M contains the movements of i∈ξc(St) J k c,t [v i ]
• 21 (⇐=) Let us prove the contrapositive of the claim. Assume that the following predicate is true

∀k ∈ {-1, 1}, ∃v i ∈ c, ∀j ∈ [1, µ k c,t (v i )], S t [v i ] = 0 ∧ S t+1 [v i+k•j[ℓc] ] = 1. (1)
This hypothesis means that it exists at least one unoccupied vertex which "virtually" moves further than both its clockwise and counterclockwise object sequences.

From this hypothesis, we have to show that M t is safe. In order to simplify the reading of this proof, assume that any calculus on the label of vertices of cycle c is done, from now, modulo ℓ c .

If

∀v i ∈ c, S t [v i ] = 1, given that |ξ t | = |ξ t+1 |, then ∀v i ∈ c, S t+1 [v i ] = 1. But, this outcome is contradictory because from the hypothesis ∃v i ∈ c such that S t [v i ] = 0. Thus, |ξ t | = |ξ t+1 | = 0.
Assume that for a vertex v i , S t+1 [v i ] = 0. From the system model definition (see Section 3), an object cannot move more than one vertex distance between two consecutive time steps. Then, no object has moved through v i between t and t + 1. Based on this unoccupied vertex between two consecutive time, it is always possible for the observer to extrapolate deterministically the movement of objects in c. So, M t is safe.

Thus, assume that ∀i ∈ ξ c (S t ), S t+1 [v i ] = 1, otherwise, using the same method, M t must be safe. Given this assumption and Hypothesis 1, it is possible to infer that ∃i

∈ ξ c (S t ), ∀j ∈ [-µ -1 c,t (v i ), µ +1 c,t (v i )], S t+1 [v i+j ] = 1. Moreover, it is trivial that ∀i ∈ ξ c (S t ), (i + µ +1 c,t (v i ) + 1) ∈ ξ c (S t ) and (i -µ -1 c,t (v i ) -1) ∈ ξ c (S t )
, given Definitions 7.3 and 7.4. The vertices labeled by these two naturals are then occupied at time t + 1, but unoccupied at time t.

So, ∃i ∈ ξ c (S t ), ∀j ∈ [-µ -1 c,t (v i ) -1, µ +1 c,t (v i ) + 1], S t+1 [v i+j ] = 1.
In that case, as v i is occupied at time t + 1, assume, without loss of generality, by the symmetry of this statement, that an object has moved in counterclockwise from v i-1 to v i . Then, as S t+1 (v i-1 ) = 1, one another object has necessarily moved from v i-2 to v i-1 , and so forth until v i-µ -1 c,t (vi) . So, an object has moved from v i-µ -1 c,t (vi)-1 to v i-µ -1 c,t (vi) given the assumption S t+1 [v i-µ -1 c,t (vi) ] = 1. Or, (iµ -1 c,t (v i ) -1) ∈ ξ c (S t ). Then, obviously, no object has moved from v i-µ -1 c,t (vi)-1 to v -µ -1 c,t (vi) between t and t + 1. This movement is then impossible. The condition ∃i ∈ ξ

c (S t ), ∀j ∈ [-µ -1 c,t (v i ) - 1, µ +1 c,t (v i ) + 1], S t+1 [v i+j ] = 1 is then never verified. From that, by contradiction, ∃i ∈ ξ c (S t ), S t+1 [v i ] = 0.
Thus, as it exists at least one unoccupied vertex in c at time t and t + 1, using the same method than above, the movement M t is safe.

The previous theorem leads to an operative corollary that can be used to prevent unsafe movements. The following corollary leverages the observation that a necessary condition for a movement to be unsafe is that this movement makes all unoccupied vertices virtually move between S t and S t+1 . For instance, in Figure 5, page 15, if at least one element of the set of unoccupied vertices (i.e. {v 1 , v 7 , v 10 }) remains unoccupied after a movement, then this movement is safe. Formally: COROLLARY 7.6. Given a P CG and a state vector S t , such that S t is unsafe, consider c ⊆ G a cycle such that c respects the condition of Theorem 7.1. If less than |ξ c (S t )| objects move in this cycle between t and t + 1 , then the movement is safe. PROOF. By Theorem 7.5, an unsafe movement must verify the following condition:

∃k ∈ {-1, 1}, ∀i ∈ ξ c (S t ), ∃j ∈ [1, µ k c,t (v i )], (i + k • j mod ℓ c ) ∈ ξ c (S t+1
). This implies that given a direction of movement (either clockwise or counterclockwise), the location of all unoccupied vertices virtually move between t and t + 1.

(j ∈ [1, µ k c,t (v i )]
). Thus, if only less than |ξ c (S t )| objects are allowed to move, it exists at least one unoccupied vertex at time t, which will remain unoccupied at time t + 1, therefore the previous condition cannot be verified and the claim follows.

Note that this corollary gives us a practical rule we can use at a specific point in time to avoid an unsafe movement. This can be obtained by blocking a number of objects located in the P CG's cycles that is always lower than the value k obtainable applying Theorem 6.1.

CONSTRAINING NODE MOVEMENTS ON-LINE BY AN ACTIVE OBSERVER

This section presents two algorithms that can be run by an observer in order to solve MOTI. The first is based on the state graph, the second on P CG. The structure of the algorithms is the same: the observer first verifies if the system is in a safe state. In the affirmative case, the observer allows any movement of objects. On the contrary, i.e. if the system is in an unsafe state, the observer can act on the system by limiting the movement of some objects, based on the result of either Theorem 6.1, or Corollary 7.6.

An algorithm based on the State Graph

Each time the observer receives a state vector S t , it executes Algorithm 1: Note that the selection done at line 3 can be performed using any selection strategy. This algorithm checks at each time if the next movement leads to an unsafe state using SG to verify if the current state is safe. If it is not, according to the Theorem 6.1, this algorithm blocks movements of all but k objects in the system.

An algorithm based on P CG

The following algorithm improves the previous one by removing the need for the observer to calculate the SG, and by reasoning only on cycles of the P CG and the state vector S t .

Each time the observer receives a state vector S t , it executes Algorithm 2.

To verify if S t is safe, the observer has to check that each cycle in P CG satisfies the assumption of Corollary 7.2 (line 4). This means that all objects in this cycle can move freely. On the contrary, if the state S is unsafe (line 7), the observer leaves at most |ξ c (S t )| -1 objects in the cycle to move between time t and t + 1, according to Corollary 7.6. Therefore, MOTI remains solvable for this specific cycle. Then, as all cycles are considered in this algorithm, MOTI can be solved in the interval [t i , t j ]. More refined algorithms that block as few objects as possible while keeping MOTI solvability can be envisaged, but this is out of the scope of this paper.

DISTRIBUTED UNSAFE STATE DETECTION

Based on Corollary 7.2 we can derive a distributed algorithm to detect the presence of unsafe states where this detection does not rely on an omniscient observer but is done locally at each sensor. Note that this algorithm does not allow to solve MOTI unless binary sensors are connected to actuators used to block unsafe movements by modifying (temporarily) the P CG. Such actuators can, for example, close a barrier on a road, thus avoiding a potential unsafe movement. This actually corresponds to break a cycle in the P CG.

Assume that each sensor s runs the same code and each sensor is aware of a sub-graph of the P CG including only its neighbors. This graph is a star, denoted ST AR s (V ′ , E ′ ), where s ∈ V ′ is the vertex in the center of the star with vertex degree equal to |V ′ | -1. ST AR s is a subgraph of P CG. We also assume that the speed of messages is much higher than the one of objects. The algorithm works as follows:

-A sensor s notifies any change of its state to its neighbors by sending to each sensor s ′ ∈ ST AR s , a message U P DAT E(state, s). -Upon the arrival of a message U P DAT E(state, s ′ ) at a sensor s, -s updates the state of its neighbor s ′ ; -for any path s ′ , s, s ′′ in ST AR s such that this path has at least two vertices hosting an object, s sends a message P ROBE(seq, s) to either s ′ or s ′′ . This message includes a sequence number and the identifier of the originator of this probe. -Upon the arrival of a message P ROBE(seq, id) from a neighbor s ′ at a sensor s, the following cases are possible: -id = s: for any node s ′′ belonging to the path s ′ , s, s ′′ in ST AR s such that this path does not contain two consecutive unoccupied nodes (Corollary 7.2), s relays P ROBE(seq, id) to s ′′ ; -id = s: the state is unsafe. Indeed, a P ROBE message sent by s has been received by s itself, this means that s belongs to a cycle of the P CG and along this cycle there are not two consecutive vertices that do not host objects;

Note that all the sensors in the cycle detect the unsafe state as all of them initiate sending their own probe message. The drawback of this simple algorithm is the number of exchanged messages. This number can be traded with the knowledge of P CG owned by a sensor. Of course the larger the knowledge, the lesser the load. For example, if we consider that each sensor knows the entire P CG, we can simply run the previous algorithm by assuming that each sensor s works on a star graph ST AR * s obtained from ST AR s by suppressing the vertices in ST AR s that do not belong to a cycle in P CG. Note that if a sensor does not belong to any cycle in P CG, its star graph is a singleton graph. In this way, all sensors not belonging to any cycle do not participate to the unsafe state detection algorithm and, thus, do not generate and relay useless P ROBE messages. Also U P DAT E messages are exchanged among sensors involved in at least one cycle in P CG.

Further distributed algorithms that save more messages can be envisaged but this is out of the scope of this paper.

CONCLUSION

Automatically tracking object movements by means of sensors has strong practical impacts in several industrial fields. As such it has been tackled in various different setting since the seventies.

In this paper, we have considered a set of anonymous objects moving on the top of a binary sensor network (represented by a generic graph -Passage Connectivity Graph) and studied the problem of deterministically associating a trajectory of a single object with a track revealed by the sensor network, namely the Multiple Object Tracking and Identification (MOTI) problem. This problem can be considered as a specific instance of the more general problem of deciding how many trajectory hypotheses can be generated by a set of observations done through sensors [START_REF] Crespi | The theory of trackability with applications to sensor networks[END_REF]: in this case we were interested in all those settings where the set of hypotheses always contains a single trajectory for each moving object. We have shown that solving MOTI is impossible even in a very favorable environment with ideal sensors, in which objects activate exactly one sensor at a time, there are no false object detection and there is the presence of an omniscient observer that knows the state of the entire graph.

Following this impossibility result, we have investigated which constraints could be added to the environment to make such associations possible. More specifically, we have shown that MOTI can be solved either if the graph is acyclic or the length of the smallest cycle in the graph is strictly greater than the double of the number of objects that can concurrently move in the system. This leaves the opportunity to modify the topology of the passage connectivity graph like for example in an indoor scenario. Once the maximum number of moving objects is known, our results mainly impact the deployment phase of a sensors network.

If we consider the issue of solving MOTI on-the-fly (i.e. without imposing constraints in the deployment phase), we also provided a characterization of MOTI solvability based on the state of sensors belonging to cycles of P CG. Using this characterization, an omniscient observer can assess on-the-fly the risk of violating MOTI (safeness of the system) and then, take the decision of blocking some specific objects to eliminate that risk. A corollary to this characterization led to a condition for detecting the safety of the system based on the state of adjacent sensors in cycles of a passage connectivity graph. This local condition leads to the design of some distributed algorithms that can be run by each sensor, avoiding Several open questions have still to be considered and are left for future work. For instance, a challenging aim consists in refining our algorithms in order to block as few objects as possible while keeping MOTI solvability, and characterizing the optimal complexity according to different heuristics. Alternatively, it would be possible to envisage scenarios, and consequently algorithms working on them, where objects can be moved in order to solve unsafe conditions, or where further sensors can be deployed to increase the ability of the system to distinguish independent trajectories. Furthermore, distributed algorithm, cheaper with respect to the number of messages used, can be can be designed in order to make their execution more efficient in settings where energy consumption is an issue.

Fig. 1 .

 1 Fig. 1. Example of real and observed trajectories of 3 object o 1 , o 2 , o 3 in the interval [t 0 , t 3 ]: Pt 0 ,t 3 ,o 1 = [C, D, E, I]; Pt 0 ,t 3 ,o 2 = [H, G, B, A]; Pt 0 ,t 3 ,o 3 = [M, K, L, L].

Fig

  Fig. 2. A simple example in which the observer cannot track precisely the trajectories of objects: For a P CG presented in (a) with two objects, two global trajectories P and P ′ , presented in (b) and (c) respectively, can occur and the observer is not able to distinguish them with only the information presented on (d) if objects have moved following trajectory P or P ′ .

Fig. 3 .

 3 Fig. 3. Example of a state graph for the left 4 vertex P CG including 2 objects.

Fig. 4 .

 4 Fig. 4. Representation of the P CG which illustrates the possible existing paths connecting v 1 and v n+2 .

1Fig. 5 .

 5 Fig. 5. Unoccupied vertices set and object sequence.

Fig. 7 .

 7 Fig. 7. Possible system evolutions of a sub-cycle from the state St to the state S t+1 .

Fig. 8 .

 8 Fig. 8. Example of a safe movement from the state St to a state S t+1 .

Fig. 9 .

 9 Fig. 9. Example of unsafe movements from the state St to a state S t+1 .

  objects located in c that move counterk-wise (where counter-k-wise means clockwise if k = +1 and counterclockwise if k = -1); -M ′ contains the movements of ℓ c -i∈ξc(St) J k c,t [v i ] objects located in c that move k-wise (where k-wise means clockwise if k = -1 and counterclockwise if k = +1).

  the omniscient observer for detecting risks of violating MOTI.

  ∃v ′ ∈ Adj c (v) st S t [v] = S t [v ′ ] = 0

				• 23
	Algorithm 2:
		Data: a P CG, a state vector S t
	1	ℓ ← 2;
	2	repeat
	3	foreach cycle c ∈ P CG with length ℓ do
	4	if ∃v ∈ c, % Corollary 7.2
	5	then
	6	continue;
	7	else
	8	k ← |ξ c (S t )|;	% the state is unsafe
	9	Let only k -1 objects do a free movement in c;	% Corollary 7.6
		ℓ + +;
	11

10

until there are no cycles with length equals or greater than ℓ in the P CG ;

ACM Journal Name, Vol. V, No. N, August 2010, Pages 1-27.

ACM Journal Name, Vol. V, No. N, August 2010.

Acknowledgments

This work is partially supported by the European Network of Excellence RESIST and by the European Project SM4ALL. The authors are indebted with the reviewers for their comments and suggestions that greatly improved presentation and content of the paper. A short and preliminary version of this paper [Busnel et al. 2008] appeared at DCOSS '08 (International Conference on Distributed Computing in Sensor Systems).

• 27 A. APPENDIX A.1 An algorithm for computing SG In this appendix, we propose a state graph construction algorithm, based on the conditional transitive closure of a one-movement only state graph. This condition ensures that no inconsistent movement will be included in the state graph generated by the algorithm.

Algorithm 3: State graph construction

Data: a P CG, the number of moving object x Result: the associated state graph SG(S, M) This protocol is composed of two main parts. The first part begin by creating an empty edge set and a complete vertices set. Then, starting from line 3 to line 6, the algorithm puts in the state graph all one-object-movement edges. Secondly, from line 7 to line 13, following the same mechanism as the one used in the Floyd-Warshall algorithm for transitive closure computation, three nested loops compute iteratively all possible movements with any number of concurrent movements. Finally, the last lines, from 14 to 15, merge symmetric movement edges in order to return an undirected state graph.

The termination of this protocol is trivial as it is composed only of nested loops of finite length. Moreover, the complexity of this algorithm is obviously O(|S| 3 ) as it contains three nested loops on S.

The correctness of this algorithm is based on the correctness of the Floyd-Warshall algorithm [START_REF] Floyd | Algorithm 97: Shortest path[END_REF][START_REF] Warshall | A theorem on boolean matrices[END_REF]]. The condition of line 12 only ensures that no inconsistent movement can be included in the state graph, and given that new edges in SG are generated from consistent movements, no existing movement can be ignored.