Method and System for Fusing Data From Fixed and Mobile Security Sensors

The present invention relates to the general field of intrusion detection systems for secure environments, and more particularly to a system that integrates the outputs of both fixed and mobile intrusion detection sensors in order to provide intelligent assessments of the level of security of the environment.

Most security systems utilize fixed sensors such as motion detectors and/or video cameras positioned at specific locations throughout the environment to be secured. Such environments include buildings, military bases, warehouses, storage yards, factories, and even homes. A very great disadvantage with video camera surveillance is that it requires an alert human to monitor a bank of video displays over long periods of time. If the human becomes distracted or fatigued, he may not notice an intrusion. Another problem with such security systems is that in order to be sensitive enough to detect a potential intrusion, they are subject to nuisance trips. This causes erosion in confidence in these systems. Furthermore, such systems do not provide sufficient resolution to be able to identify the specific nature of an intrusion or its precise location. Further, fixed positioned intrusion detectors are not capable of tracking an intruder's position with any real accuracy.

If the environment to be secured is very large, it becomes economically difficult to provide adequate sensor coverage throughout the entire environment with fixed sensors. Furthermore, the fact that the sensors are positioned at fixed locations makes them vulnerable to being neutralized by a determined intruder.

There exists a tradeoff point wherein it becomes more cost effective to outfit a platform with numerous sensors, and let it travel from zone to zone, as opposed to installing, wiring, and protecting the fixed installation of these same sensors so that all areas within a space are effectively covered. This is obviously a function of the conditions to be monitored and the unit cost of the appropriate sensors, as well as the number of areas and geometric configuration of the space to be protected. Some provision must be made to preclude site vulnerability when the robot is not on station, or perhaps even down for maintenance. For these reasons, a combination of both fixed and mobile sensors is likely to evolve as the appropriate solution in most cases, but obvious problems arise with the operation of a mobile platform in an area protected by permanently installed motion detectors, in that the motion of the robots will set off the fixed alarms.

Therefore, a need exists for a security system which allows one or more mobile robots to operate in an area protected by fixed intrusion detectors. Furthermore, a need exists for an intrusion detection system that is capable of detecting the presence of a potential intrusion, then scrutinizing the potential intrusion with greater resolution to ascertain the nature of the intrusion, then determining the probability of an actual intrusion to minimize nuisance trips, and then providing an intruder alarm if the threat of intrusion exceeds a specific level of confidence that an actual intrusion has occurred.

The present invention provides a system for detecting intrusion into a secured environment using both fixed and mobile intrusion detectors. The invention employs an optimal mix of fixed sensors, positioned at specific locations throughout the environment, and sensors mounted on one or more mobile robots that patrol the secured environment. The outputs of the fixed and mobile sensors are fused by a computer-based system that emulates the assessment functions of its human counterpart. The system knows at all times where the robots are located, the zones of coverage for the mobile sensor suites, and the resultant effect of the robot's presence or motion on fixed intrusion detection sensors viewing that same area.

The concept of mobility provides an unpredictable pattern with respect to precise sensor location and orientation, making the job of casing a scenario for the purpose of identifying blind spots rather difficult indeed. The random patrols and the uncertainty in the mind of the intruder as to what the robot's response might be upon detection adds a psychological advantage to the deterrent function of the security system. An important advantage of the present invention is that if the fixed sensors detect a potential intrusion, the computer directs a mobile robot to the vicinity to investigate the situation further.

The sensor suite onboard the mobile robot contains multiple, high resolution sensors of different types that are automatically oriented towards the potential intruder. Data obtained from the mobile sensors is used to determine the probability of an actual intrusion so that nuisance trips are minimized. If an actual intrusion has occurred, the mobile robots are directed by the computer to follow the intruder and report the intruder's position. All this occurs in realtime. If the confidence level of an intrusion exceeds a threshold, an intruder alert is provided. Thus, this invention obviates the demanding and tedious vigilance of a human required by conventional security systems.

A multiplicity of fixed intrusion detection sensors are each deployed at specific, fixed locations within the environment. The mobile sensors are mounted on robots which selectively patrol throughout the environment and may be rapidly deployed to any region in the environment where a fixed intrusion detector detects a possible intrusion. A computer receives the outputs of the fixed and mobile sensors and is communicatively coupled to the mobile robots. The computer directs the mobile robots to travel through the environment along paths calculated by the computer, calculates a sum of weighing factors associated with the output of each sensor, and fuses the sensor outputs so that the sum is uninfluenced by the traveling of the mobile robots. The sum is compared to a reference whereby an output is provided when the sum exceeds the reference. An alarm system operably coupled to the computer provides an intrusion alert when the output received exceeds the reference. X-Y positional data and the activated sensor corresponding to an identified intrusion is presented on a video display.

Data fusion is accomplished such that the robot's motion does not trigger a `fixed` sensor alarm, and data from both `fixed` and `mobile` sensors can be collectively assessed in calculating a composite threat score from individual sensor weightings, so as to achieve a high probability of detection with a corresponding low nuisance alarm rate.

The present invention also provides a method for operating a security system having fixed and mobile intrusion detectors in a secured environment, where the mobile intrusion detectors are mounted on one or more mobile robots, and each the fixed and mobile intrusion detectors has a coverage zone. This method includes the steps of: (1) initializing a mathematical model of a fixed intrusion detector map comprised of nodes each having an initial value; (2) determining the position of the mobile robot; (3) initializing a mathematical model of a mobile intrusion detector coverage map comprised of nodes having an initial value; (4) reading the outputs of the fixed and mobile intrusion detectors; (5) determining which the fixed intrusion detector coverage zones include the position of the mobile robot; (6) inhibiting data corresponding to the outputs of any of the fixed intrusion detectors that have the coverage zones that include the mobile robot; (7) assigning a weight to data corresponding to each mobile intrusion detector zone associated with a mobile intrusion detector detecting a potential intrusion by: (8) examining a sequence trigger history of the mobile intrusion detectors in order to ascertain the presence of purposeful motion by the potential intrusion in any of the mobile intrusion detector zones associated with a mobile intrusion detector detecting the potential intrusion; (9) increasing the weights calculated in step 7 for each mobile intrusion detector threat score by a predetermined amount for each of the mobile intrusion detector zones in which the purposeful motion is detected; (10 ) determining a mobile intrusion detector threat score by summing the weights determined in steps 7, 8 and 9; (11) correlating the outputs of the fixed and mobile intrusion detectors by identifying a maximum weighted sum corresponding to the outputs of the fixed intrusion detectors detecting the potential intrusion, and having an associated fixed intrusion detector zone that intersects a mobile intrusion detector zone in which the potential intrusion has been identified by; (12) rotating and translating the activated mobile intrusion detector zones associated with the mobile intrusion detectors detecting the potential intrusion into the mobile coverage map; (13) assigning a value to each of the mobile intrusion detector coverage zones associated with the mobile intrusion detectors detecting the potential intrusion to a predetermined value; (14) correlating the fixed intrusion detector coverage map with the mobile intrusion detector coverage map for each location within the mobile intrusion detector coverage zone which intersects the interior of one or more fixed intrusion detector sensor zones associated with a fixed intrusion detector detecting the potential intrusion to produce a weighted sum representing a probability of an intrusion by: (15) determining a maximum fixed intrusion detector threat score corresponding to the activated fixed intrusion detectors; (16) determining a composite global threat score by summing the mobile intrusion detector threat score and the maximum intrusion fixed sensor threat score; and (17) providing an alarm signal to an alarm output device if the composite global threat score is greater that the threshold value.

Another advantage of the invention is that it provides geographic correlation of fixed and mobile sensor alarm data. A further advantage is that it provides a high probability of detection with a low nuisance alarm rate by assigning "weights" to data representing intrusion detector outputs.

FIG. 1 is a block diagram of the present invention.

FIG. 2 is a more detailed block diagram of the present invention.

FIGS. 3A and 3B are a schematic diagram of the alarm interface unit.

FIG. 4 is a block diagram of the mobile robot.

FIG. 5 is a functional block diagram of the sonar subsystem.

FIG. 6 is a perspective view of the autonomous vehicle used in conjunction with the present invention.

FIG. 7 is a perspective view of the propulsion module.

FIG. 8 is a schematic electrical diagram of the multiplexer portion depicted in FIG. 5 of the present invention.

FIG. 9 is a schematic electrical diagram of the transducer switching relay (Detail A) of FIG. 8.

FIG. 10 are flowcharts of the function of the controlling processor associated with the sonar system of the present invention.

FIG. 11 is a block diagram of the acoustic detection array.

FIG. 12 is schematic diagram of the amplifier/detector circuit of the acoustic detection array.

FIG. 13 is an example of an environment in which the present invention may operate.

FIG. 14 illustrates a path and obstacles obstructing the path of the vehicle within the environment presented in FIG. 13.

FIG. 15 is a three dimensional probability distribution plot showing the perceived location of nearby objects and obstacles within the environment illustrated in FIG. 14.

FIG. 16 is a flowchart of the Path (World) Planner program software.

FIG. 17 is a flowchart of the Find-Path program software.

FIG. 18 is a flowchart of the Expand program software.

FIG. 19 is a flowchart of the Retrace program software.

FIG. 20 is a flowchart of the Execute Path program software.

FIG. 21 is a flowchart of the Execute Segment program software.

FIG. 22 is a flowchart of the Map Sonar program Software.

FIG. 23 is a flowchart of the Local Assessment Software.

FIG. 24 is flowchart of the Update Sensor Software which is a subroutine of the software presented in FIG. 23.

FIG. 25 is a flowchart of the Assess Threat Software which is subroutine of the software presented in FIG. 23.

FIG. 26 is flowchart of the Adjust Weight Purposeful Motion Software which is a subroutine of the software presented in FIG. 25.

FIG. 27 is a flowchart of the Calculate Global Zone Weight Software which is a subroutine of the software presented in FIG. 25.

FIG. 28 is a flowchart of the Adjust Weight Angular Sensor Fusion Software which is a subroutine of the software presented in FIG. 25.

FIG. 29 is a flowchart of the Calculate Threat Software which is a subroutine of the software presented in FIG. 25.

FIG. 30 illustrates the intrusion detection coverage zones of the mobile robot.

FIG. 31 illustrates a plan view of the secured environment as presented on a video display and sensor output data.

FIG. 32 is a flowchart of software for initializing the fixed sensor coverage map.

FIG. 33 is a flowchart of software for performing threat assessment.

FIG. 34 is a flowchart of software for inhibiting the fixed sensors.

FIGS. 35A and 35B present a flowchart of software for performing fixed and mobile sensor output correlation.

FIG. 36 is a flowchart of software for adjusting the weights of the bits corresponding to the sensor outputs.

The present invention provides an intrusion detection system which synthesizes data provided by one or more groups of intrusion detectors mounted on mobile robots with data provided by a fixed intrusion detection system in order to compile a composite intrusion threat level of an environment which is to be secured. A composite intrusion threat level exceeding a specified threshold results in an intrusion alert.

An overview of the present invention is described with reference to FIG. 1, where there is shown fixed sensor system 12 which preferably includes a multiplicity of different types of intrusion detectors that provide outputs to host computer 14 through alarm interface unit 16. The invention also includes one or more security sensor systems 19 each mounted on a mobile robot 18 which patrols throughout the environment. Security sensor systems 19 are communicatively linked to host computer 14 via radio frequency link 20 Algorithms implemented by software in host computer 14 integrate the outputs of fixed sensor system 12 and security sensor system 19 in order to determine the composite intrusion threat level. If the composite intrusion threat level exceeds a predetermined threshold value, an alert signal is output from host computer 14 through alarm interface unit 16 to enable alarm system 22. A human operator monitoring alarm system 22 then may appropriately respond.

This invention also provides navigational control for the mobile robots 18 which: 1) periodically identifies the location and orientation of the mobile robot, 2) plans a path for the robot to follow from its present location to a specified destination, and 3) provides directions to the mobile robot so that the path is executed in a manner whereby the mobile robot avoids running into anything.

A more detailed description of the present invention is presented with reference to FIG. 2. Fixed sensor system 12 may include several different types of sensors, as for example, door closure sensor 12a, window closure sensor 12b, microwave area sensor 12c, break-beam sensor 12d, passive infrared sensor 12e, pressure mat 12f, and video motion detector system 12g, comprising video camera 12g.sub.1 and video motion detector 12g.sub.2. Such sensors are well known and commercially available. However, in the preferred embodiment, video motion detector 12g.sub.2 is of the type described in in U.S. Pat. No. 5,034,817 (application Ser. No. 07/486,465), Reconfigurable Video Line Digitizer And Method For Storing Predetermined Lines Of A Composite Video Signal, filed Feb. 28, 1990, incorporated herein by reference.

Referring still to FIG. 2, the video signal output from video motion detector system 12g is provided to video multiplexer (MUX) 24 and then is received by video recorder (VCR) 26 and displayed on video monitor 28. RF link 20 includes RF link 20a coupled to host computer 14, RF data transmitter 20b.sub.1 mounted onboard mobile robot 18, and RF video transmitter 20b.sub.2, also mounted on mobile robot 18. The video signal provided by video link 20b.sub.2 is received by video receiver 20c, directed to MUX 24, and optionally stored by VCR 26 and displayed by video monitor 28. Alarm system 22 provides an alert signal when the outputs of fixed sensor system 12 and/or sensor system 19 detect perturbations within the secured environment that have a high probability of corresponding to an intrusion. Each of these major systems are described in greater detail further herein.

Fixed intrusion detection system 12 includes a multiplicity of sensors capable of detecting perturbations within the area to be secured that may correspond to intrusions caused by entry of unauthorized personnel or to other conditions inimical to the security of the area, as for example, fire. The sensors are positioned at fixed locations throughout the area to be secured in order to provide a high probability of detecting any such disturbances, as would be well known by those skilled in this art.

The outputs of the sensors which comprise intrusion detection system 12 are received by alarm interface unit 16 which routes them to host computer 14. Computer 14 evaluates the data, and if an intrusion is detected, outputs an intrusion alert via alarm interface unit (AIU) 16 so as to enable alarm system 22.

Alarm system 22 includes an annunciation device, such as a bell or siren, and a panel of indicator lights which show the status of the individual sensors of fixed sensor system 12. Such light panels are well known and commonly employed in the security industry. Alarm system 22 responds to the various signals provided by alarm interface unit 16.

Alarm interface unit (AIU) 16 is intended to make the present invention compatible with existing installation security systems consisting principally of an alarm system 22 and a plurality of fixed sensors such as are depicted in FIG. 2 as sensors 12.sub.a-g. AIU 16 provides an interface to host computer 14 which allows the host computer to ascertain the status (alarmed or clear) of the individual fixed sensors 12.sub.a-g. In addition, AIU 22 provides an output interface which allows host computer 14 to relay this status information to alarm system 22. AIU also provides an output signal via the VCR control line which allows host computer 14 to start and stop VCR 26, and an output signal via a video MUX control line which allows control of video multiplexer 24.

AIU 16 is described with reference to FIGS. 3A and 3B. AIU 16 has, by way of example, 16 inputs on each of two IC's 4067, 8 outputs from each of four IC's 74LS244, and is connected to the 8-bit parallel printer port of host computer 14. In order for AIU 16 to control 32 inputs and 32 outputs, it uses five bits (DB0-DB4) from the standard 8-bit parallel PC printer port as address bits. Pin number, data bit, and function of each bit are listed in TABLE 1. Bit DB5 is used to determine if AIU 16 is reading or writing (input/output). The DB6 (DATA.sub.-- OUT) bit outputs data, while the ACK (DATA.sub.-- IN) bit is used for receiving data.

In order to send a data bit to one of 32 outputs, the WR/RD (DB5) line is set to a logic high. DB0-DB2 (OUTA0-OUTA2) provide the lower three output address lines. Since the 74LS259 addressable latch only has three input address lines and 8 outputs, a dual 2-to-4 74LS139 multiplexer is employed to allow four 74LS259 chips to be accessed, as determined by appropriate logic levels provided by DB3 (SELA) and DB4 (SELB). Each output from the 74LS139 is connected to the ENABLE input of one of the four 74LS259 multiplexer chips. The logic level of SELA and SELB thus determine which one of the four 74LS259 is enabled. OUTA0-OUTA2 then provide the necessary address to select the desired output port on the enabled 74LS259, whereupon.sub.13 DATA OUT determines the logic level of that selected port. Once an output port state is set, it will retain the same value even after another port is selected. The value of an output port can only be changed if its corresponding address is set on lines DB0-DB4, otherwise the port value remains the same.

In order to read in an input from AIU 16, the WR/RD line (DB5) is set to a logic low. OUTA0-SELA are used as the lower four address lines. The logic level of SELB, connected to 74LS139, determines which of the two 4067 analog multiplexers is enabled. If SELA is low, then ports 1-16 are available, whereas if SELB is high, then ports 17-32 are selected.

Programming required to control the operation of AIU 16 is implemented in host computer 14 and may be written in "C", as presented, by way of example, in Appendix 1.

Referring to FIG. 4, mobile robot 18 is a mobile platform which includes local processor 402, propulsion module 416, sensor system 19, and collision avoidance system 450. Propulsion module 416 receives instructions from host computer 1 that direct it along a particular path. Collision avoidance system 450 provides data to host computer 14 via local processor 402 for indicating the presence of obstacles that may obstruct the path of mobile robot 18. More detailed descriptions of each of these systems which comprise mobile robot 18 are presented further herein. Mobile robot 18 is capable of being navigated throughout the operating environment by instructions provided by host computer 14 through local processor 402. Techniques for navigating a mobile platform in the manner employed in the preferred embodiment of the present invention are well known by those skilled in this technology, and are incorporated into a number of commercially available units. [Refer to U.S. Pat. No. 4,811,228, Method of Navigating An Automated Guided Vehicle, incorporated herein by reference].

Local processor 402 performs the following functions: 1) coordinates the operations of all of the systems of mobile robot 18; 2) receives high level instructions from host computer 14; 3) passes drive commands to propulsion module 416; 4) receives X-Y position and heading updates from processor 417 of propulsion module 416; 5) receives range and bearing data representing the area surrounding mobile robot 18 from processor 532 (See FIG. 5); 6) checks for potential collision conditions; 7) sends stop commands to propulsion module 416 if a collision is eminent; and 8) passes required positional and sonar information to host computer 14.

Local processor 402 may be programmed to perform the above recited functions in a high level language such as "C", or in an assembly language, such as 6502, in accordance with well known techniques, as set forth, by way of example, in Appendix 2.

Referring to FIGS. 6 and 7, mobility and dead-reckoning position determination of mobile robot 18 depends on two degree-of-freedom, computer-controlled propulsion module 416 having motion directed by local processor 402 which is mounted on mobile robot 18. Local processor 402 provides output instructions to processor 417 (FIG. 2) of propulsion module 416 in response to data received from host computer 14 so that mobile robot 18 may follow a path calculated by host computer 14. Processor 417 is typically provided as a component of commercially available propulsion modules of the type employed in the preferred embodiment of the present invention.

Commands are passed by local processor 402 to processor 417 which controls propulsion module 416 over a serial or parallel bus as a series of hexadecimal bytes which specify: (1) the direction in which to move or pivot, (2) the velocity, and, (3) the duration (distance or number of degrees.) The functions of propulsion module 416 include executing movement commands received from local processor 402 and performing dead-reckoning calculations. In an example of the preferred embodiment, these commands are:

00 - Move forward

01 - Move reverse

02 - Pivot left

03 - Pivot right

04 - Offset left

05 - Offset right

07 - Stop

Byte 2 - Requested Velocity

Upper nibble is the port motor velocity;

Lower nibble is the starboard motor velocity.

Byte 3 - Distance to Move (Inches) or,

Duration of Pivot (Degrees) or,

Amount of Offset (Tenths of Degrees)

Velocity control and acceleration/deceleration ramping are performed by processor 417 on an interrupt basis, while the main code performs all dead reckoning calculations. Cumulative X and Y components of displacement as well as current heading, .theta., are passed up the hierarchy via local processor 402 at recurring intervals so that host computer 14 knows the location of mobile robot 18 in order to integrate data from sonar system 435 into a world model which is constantly being updated with new information. The programming which enables local processor 402 to control propulsion module 416 is typically provided with commercially available propulsion modules similar to the type described above. Examples of commercial models of suitable propulsion modules are the "LABMATE," manufactured by Transitions Research Corporation, 15 Great Pasture Road, Danbury, Conn. 06810, or the "NAVMASTER" by Cybermotion, 5457 Aerospace Road, Roanoke, Virginia, 24014.

Referring to FIGS. 6 and 7, by way of example, propulsion module 416 includes a pair (only one wheel is shown) of coaxially aligned wheels 422 which are each driven by separate motors 424 which enable propulsion module 416 to be differentially steered by rotating each wheel 422 by different amounts, both in angular displacement and direction. Wheels 422, may for example, have 8-inch rubber tires, which when coupled with motors 424, provide a quiet, powerful propulsion system with minimal wheel slippage. Passive casters 423 mounted to propulsion module 416 provide it with stability. Armature shafts 428 of motors 424 are each coupled to a high-resolution optical rotary shaft encoder 426 that provides phase-quadrature, square-wave outputs, where each square-wave output corresponds to a specific increment of angular displacement of a wheel 422. By way of example only, in the preferred embodiment, encoders 426 produce 200 counts per revolution of armature shaft 428, which translates to 9725 counts per wheel revolution. Commands from local processor 402 direct the kinematics of propulsion module 416, as for example, heading, velocity, and acceleration. Processor 417 (FIG. 2) of propulsion module 416 provides host computer 14 with its instantaneously computed dead-reckoning position and heading which is calculated by counting the number and discerning the phase relationships of the square-wave outputs of each encoder associated with each wheel 422. Power to operate mobile robot 18 is provided by battery 430 in accordance with well known techniques.

Collision avoidance system 450 (see FIGS. 4-5) is used to detect obstacles in the path of mobile robot 18 and provide data to host computer 14 so that the path planner program can endeavor to calculate a path which avoids any detected obstacles. Referring to FIGS. 5, 8 and 9, collision avoidance system 450 includes processor 532, multiplexer 534a and transducer array 536a. Processor 532 of collision avoidance system 450 receives commands from local processor 402 and provides ranges and bearings, detected by transducer array 536a, from mobile robot 18 to nearby detected surfaces that may present obstacles in the path of mobile robot 404. When an obstacle is detected within 5 feet of mobile robot 18, host computer 14 updates the world model, as will be described further herein, using target range information provided by processor 532 through local processor 402 to host computer 14. This range information is combined with additional information describing the heading, .theta., of mobile robot 18 as well as X-Y position data. If local processor 402 determines that any range reading is less than some critical threshold distance (as for example, 18 inches in the preferred embodiment), indicative of an imminent collision between mobile robot 18 and an obstacle, then local processor 402 sends a "halt" command to processor 417 (FIG. 4) of mobile robot propulsion system 416, and informs host computer 14 of this action. The path planner, implemented in host computer 14, then calculates a new path for mobile robot 18 to follow that avoids the obstacle so that mobile robot 18 may proceed to the predetermined location. Collision avoidance system 450 employs a multitude of pre-positioned ultrasonic transducers 536: (FIG. 6) that are individually activated in any desired sequence by processor 532, thus enabling collision avoidance system 450 to obtain range information in any given direction within an arc centered at the front of mobile robot 18 that extends forward in a 120 degree conical pattern. Such ultrasonic transducers are commercially available from the Polaroid Corporation.

Still referring to FIGS. 5, 8 and 9, the preferred embodiment of collision avoidance system 450 includes transducer array 536a, which may for example, consist of 7 active ultrasonic ranging sensors 536.sub.i, where .sub.i equals 1 to 7, with individual 30 degree beam widths, spaced 15 degrees apart in an arc around the front of mobile robot 18, as shown in FIG. 6. Processor 532 receives commands from local processor 402 and is operably coupled to multiplexer 534a having outputs that selectively and sequentially activate transducers 536.sub.i in accordance with instructions provided by processor 532.

The details of multiplexer 534a are illustrated generally in FIGS. 8 and 9. The seven ultrasonic transducers 536.sub.i are interfaced to ultrasonic ranging module 548 through 12-channel multiplexer 534a, in such a way that only one transducer, 536.sub.i, is fired at a time. The ultrasonic ranging module 548 may be a "Texas Instruments" ranging module, Model No. SN28827, as is well known. The heart of multiplexer 534a is a 4067 analog switch shown in FIG. 4. Processor 532 thus "sees" only one transducer 536.sub.i at a time through ranging module 548 and multiplexer 534a, and the software of processor 532 merely executes in a loop, each time incrementing the index which thus enables a specific transducer 536.sub.i of transducer array 536a.

Ultrasonic ranging module 548, if implemented with Polaroid Model No. SN28827, is an active time-of-flight device developed for automatic camera focusing, and determines the range to target by measuring elapsed time between the transmission of a "chirp" of pulses and the detected echo. The "chirp" is of one millisecond duration and consists of four discrete frequencies transmitted back-to-back: 8 cycles at 60 kHz, 8 cycles at 56 kHz, 16 cycles at 52.5 kHz, and 24 cycles at 49.41 kHz.

To simplify the circuitry involved, all timing and time-to-distance conversions are done in software on processor 532. Three control lines are involved in the interface of the ultrasonic circuit board 548 to processor 532. The first of these, referred to as VSW, initiates operation when brought high to +5 volts. A second line labelled XLOG signals the start of pulse transmission, while the line labelled MFLOG indicates detection of the first echo. Processor 532 must therefore send VSW high, monitor the state of XLOG and commence timing when transmission begins (approximately 5 milliseconds later), and then poll MFLOG until an echo is detected or sufficient time elapses to indicate there is no echo.

Four input/output (I/O) lines from processing unit 532 handle the switching function of ultrasonic transducers 5361.sub.i by activating a 4067 analog switch 544. The binary number placed on these I/O lines by the central processing unit 532 determines which channel is selected by switch 544; all other channels assume a high impedance state. Referring to FIG. 9, each of the relays 576 and its associated driver transistor 572 (illustrated in FIG. 8 as Detail A) is substantially identical. Relay driver transistor 572 is biased into conduction by current limiting resistor 543 via the active channel of analog switch 544 in such a fashion such that only one transistor 572 per switch 544 is conducting at any given time, as determined by the binary number present at the outputs of buffers 537, 538, 540, and 542. This conducting transistor 572 sinks current through its associated relay coil of relay 576, closing the contacts of relay 576. This action causes one of the transducers in array 536 to be connected to and hence driven by the ultrasonic ranging module 548, when ultrasonic ranging module 548 is activated by central processing unit 532 as described below.

Three I/O lines carry the logic inputs to processor 532 from the ranging module 548 for XLOG and MFLOG, and from processor 532 to the ranging module 548 for VSW. Non-inverting buffer 568 is used to trigger switching transistor 562 upon command from central processing unit 532 to initiate the firing sequence of ranging module 548. Resistors 558 and 560 along with transistor 556 form an inverting buffer for the XLOG signal which indicates the actual start of pulse transmission. Resistors 552 and 554 along with transistor 550 form an inverting buffer for the MFLOG signal which indicates detection of the echo. A final I/O line from processor 532 activates power switch 533, shown in FIG. 5, to power down the circuitry when not in use to save battery power.

A second parallel port on processor 532 is used to receive commands from local processor 402 which tell processor 532 to power up the ranging units, and then, which sensors to sequentially activate. Commands may be in the form of an eight-bit binary number represented in hexadecimal format, where the upper nibble represents the starting ID and the lower nibble the ending ID for the sequence. For example, the command $17 can be used to activate and take ranges using sensors #1 through #7 sequentially. Each time through the loop, upon completion of the sequence, the stored ranges are transmitted up the hierarchy to the local processor 402 over an RS-232 serial link, with appropriate handshaking. The sequence is repeated in similar fashion until such time as the local processor 402 sends a new command down, or advises central processing unit 532 to power down the ranging subsystem with the special command $FF.

The software of processor 532 may, by way of example, be structured as shown in FIG. 10. When energized by the local processor 402, processor 532 does a power-on reset, initializes all ports and registers, and then waits for a command. When a command is latched into the I/O port, a flag is set automatically that alerts processor 532, which then reads the command and determines the starting and ending identities of the transducers 536.sub.i to be sequentially activated. The interface circuitry and ranging units are then powered up, via switch 533 (FIG. 5) and the Y Register is set to the value of the first transducer to be fired.

Referring to FIG. 10 and continuing the example, Subroutine PING then is called, which enables the particular channel of analog switch 544 dictated by the contents of the Y Register. The VSW control line is sent high, which initiates operation of the ranging module 548 with the selected transducer. The software then watches the multiplexer output XLOG for indication of pulse transmission, before initiating the timing sequence. The contents of the timing counter, representing elapsed time, can be used to calculate range to the target. If this value ever exceeds the maximum specified range of the subsystem, the software will exit the loop, otherwise the counter runs until MFLOG is observed to go high, indicating echo detection. Upon exit from the timing loop, the range value for that particular transducer is saved in indexed storage, and Subroutine PING returns to the main program.

The Y Register is then incremented to enable the next ranging module in the sequence, and Subroutine PING is called again as before. This process is repeated until the Y Register equals the value of the ending index, signifying that all transducers in the sequence specified by the local processor 402 have been activated individually. Processor 532 then requests permission from the local processor 402 to transmit all the stored range values via the

RS-232 serial link. When acknowledged, the ranges are sequentially dumped out the serial interface and placed by the local processor 402 in Page Zero indexed storage. Upon completion, processor 532 checks to see if a new command has been sent down altering the ranging sequence, and then repeats the process using the appropriate starting and ending indexes. Thus the software runs continuously in a repetitive fashion, sequentially activating the specified ranging modules, converting elapsed time to distance, storing the individual results, and then finally transmitting all range data at once to the local processor 402, which is thus freed from all associated overhead. Securitv Sensor System

Referring to FIGS. 4 and 6, security sensor system 19 is mounted to propulsion module 416 and includes a multiplicity of different types of sensors capable f detecting perturbations within the secured environment of the type associated with an intrusion. In the preferred embodiment, sensor system 19 includes acoustical detection system 19a, vibration sensor 19b, infrared motion detector system 19c, microwave motion detector system 19d, optical motion detector system 19e, ultrasonic detector system 19f, video motion detector system 12g.sub.1, and acoustical monitoring system 19i. The outputs of these sensor are all provided to local processor 402 and then ultimately to host computer 14 which processes the information provided by the various sensors. Video camera 12g.sub.1 is mounted on head positioning servo 19j which is controlled by host computer 14 by techniques well known by those skilled in this art. Host computer 14 provides control signals to head positioning servo 19j in order to adjust the visual field of view of video camera 12g.sub.1, based on the perceived threat location, as discussed further herein. The outputs of acoustical monitoring microphone 19i and video camera 12g.sub.1 are provided to video transmitter 20b.sub.2.

Ultrasonic motion detection system 19f may be used to scan the environment in which mobile robot 18 operates in order to identify a potential intrusion through changes in measured target distances as seen by one or more sensors in the 24-element array. The system creates a reference template, which consists of the two most frequently observed range values for each of the individual sensors in the array, and then compares subsequent readings to this template. The presence of an intruder within the system field of view will result in a range value which does not agree with the two possibilities recorded earlier in the reference template. The new range reading will correspond to the distance to the intruder, and the index (position) of the affected sensor within the 360-degree array will provide a relative bearing, which is then used by the host computer to plot the position of the suspected intruder on the map display. Referring to FIGS. 5, 8 and 9, ultrasonic motion detection system 19f includes processor 532, multiplexers 534b and 534c, and transducer arrays 536b and 536c. By way of example, transducer arrays 536b and 536c each may include twelve ultrasonic transducers which are mounted in a 360 degree circular pattern around the top of mobile robot 18 as shown in FIG. 6. For purposes of reference, the twelve ultrasonic transducers of array 536b may be referenced as ultrasonic transducers 536.sub.i, where i=1 to 12; and the twelve ultrasonic transducers of array 536c may be referenced as ultrasonic transducers 536.sub.i, where i=13 to 24. All ultrasonic transducers 536.sub.i may be of an identical type.

Ultrasonic motion detection system 19f performs ranging in a manner that is virtually identical to the way in which collision avoidance system 450 operates. The only difference between the hardware implementations of the two systems is that ultrasonic detection system 19f includes two multiplexers and 24 ultrasonic transducers, whereas collision avoidance system 450 employs one multiplexer and seven ultrasonic transducers. Therefore, it is to be understood that the descriptions of multiplexer 534a and transducer array 536a, illustrated and described with respect to FIGS. 5, 8 and 9, also apply to multiplexers 534b and 534c, and to transducer arrays 536b and 536c. Processor 532 interacts with multiplexers 534b and 534c in the same manner as processor 532 interacted with multiplexer 534a. Furthermore, the data generated by ultrasonic detection system 19f is provided through local processor 402 to host computer 14.

Optical motion detection system 19e may be of any suitable type of commercially available optical motion detector. An example of an optical motion detectors suitable for use in the present invention is that described in U.S. Pat. No. 4,902,887, "Optical Motion Detector Detecting Visible And Near Infrared Light", incorporated herein by reference. Another type of optical motion detector suitable for use in the present invention is manufactured by Sprague, Model No. ULN-2232A.

Infrared motion detector system 19c is, by way of example, similar in operation to the Sprague Model No. ULN-2232A, identified above, except that a wavelength of 10 micrometers is used. Examples of infrared motion detectors suitable for employment in the present invention include the passive infrared sensing system manufactured by Eltec Instruments, Inc., Model No.'s 822, 826B and 4192-3, as well as passive infrared detectors manufactured by Linear Corporation, Series 6000, 8000, and 9000.

Microwave motions detectors such as employed in microwave motion detector system 19d are well known. Such detectors rely on the Doppler shift introduced by a moving target to sense the relative motion of an intruder. The electromagnetic energy associated with such detectors can penetrate hollow walls and doorways thereby allowing the sensor to "see" into adjoining rooms in certain circumstances. This operating feature permits the sensor to check locked office spaces and warehouses without the need for actual entry into such places.

Acoustical monitoring microphone 19i is described in U.S. Pat. No. 4,857,912, "Intelligent Security Assessment System", column 6, lines 30-41, incorporated herein by reference.

Vibration sensor 19b may be implemented similarly to acoustical monitoring microphone 19i except that a piezoelectric transducer, mechanically coupled to the structure of the robot 18, is used instead of a microphone such that the vibrations in the floor of the secured environment such as ma be caused by a potential intruder are coupled to the detection unit.

Acoustical detection system 19a is described with reference to FIGS. 4, 6, 11 and 12. This system provides bearing information to the source of detected noise and includes three acoustic sensor elements configured as shown in passive array 455, each operably coupled to an amplifier/detector circuit 457, shown in detail in FIG. 11. The outputs of the three amplifier/detector circuits are provided to acoustic processor 458 which may be a 6502 based, single board computer. Array 455 consists of three omnidirectional microphones 459 symmetrically oriented 120 degrees apart, and separated by a distance d, not shown. This system is mounted on top of robot 18 as shown in FIGS. 4 and 6. Sound traveling across array 455 triggers all three microphones 459 in a specific sequence dependent on the relative position of the acoustical source with respect to an array 455. Because of the symmetrical orientation of microphones 459, the firing sequence of comparators 339 associated with each microphone 459 is used to determine the bearing to the acoustical source through simple triangulation. Such passive acoustical surveillance schemes are well known by those skilled in this technology.

Video motion detection system 19g includes video surveillance camera 19h and video motion detection system 19g. The orientation of video surveillance camera 19h is controlled by head positioning servo 19j. Head positioning servos suitable for use in the present invention are well known and commercially available. Video motion detection system 19g is preferably of the type described in application Ser. No. 07/486,465, "Reconfigurable Video Line Digitizer And Method For Storing Predetermined Lines Of A Composite Video Signal", filed Feb. 28, 1990, incorporated herein by reference. Video camera 19h is further positioned to bear on the intruder using refined analysis by the output of video motion detection system 19g if the intruder's presence is detected by video motion analysis. Video motion detection system 19g is temporarily disabled as head positioning servo 19j pans to reposition camera 19h, and is re-enabled once the camera stabilizes. Software which provides the video motion analysis used to orient camera 19h is provided in Appendix 3, written by way of example, in 6502 assembly language.

Host computer 14 performs the functions of building and maintaining the "world model", a mathematical representation of the operating environment; performing path planning to generate the initial route of mobile robot 18; rerouting mobile robot 18 to avoid obstacles in its path; formulating a composite intrusion threat score based on data provided by fixed sensors 12 and mobile security sensor system 19; and providing an operator interface. Host computer 14 may be, by way of example, a 16-bit Intel 80386-based personal computer. Host computer 14 is programmed in a high level language such as "C". By way of example, the more significant source code program listings of software required to operate the present invention are described below. These and other software implemented in the present invention are identified in Appendix 1, herein. Program listings for software identified in Appendix 1 are provided in Appendix 2, herein.

Providing the capability of supporting autonomous movement of a mobile robot involves the acquisition of information regarding ranges and bearings to nearby objects, and the subsequent interpretation of that data in building and maintaining the world model. The world map is a two-dimensional array of cells, where each cell in the array corresponds to a particular square having fixed dimensions in the region being mapped. Free space is indicated with a cell value of zero; a non-zero cell value indicates the presence of an object. The cell value represents the probability of a given square being occupied, which is useful when the precise location of an object is unknown.

The acquisition of range data is accomplished by use of collision avoidance system 450. Target distance information is ultimately provided to host computer 14 which assimilates the data into the world model while mobile robot 18 is moving. Effective interpretation and utilization of range data is critical to achieve a reasonably accurate representation of surrounding obstacles. By using a simplified probability scheme and range gating fixed arrays of sonar sensors, the mapping process can take place in real-time while mobile robot 18 is in motion. FIG. 13 is a plan view of an example of an operating environment 600, or "world," which for purposes of illustration, may be a two-room laboratory, where the perimeter of the environment is composed of wall segments 602, 604, 606, 608, 610, and 612. Furthermore, by way of example to illustrate how the world map is constructed, environment 600 may also include interior walls 614 and 616; doorway 618; book shelves 620 and 622; file cabinet 624; and tables 626, 628, 630, 632, and 634. The world map may be manually edited to add additional features, such as hidden lines, doorways, etc. Each object in the world model then is automatically "grown" by half the width of mobile robot 18 in order to model the mobile robot as a point during the Find-Path operation, described further within this section. This growth is represented by the outer perimeter 636 of operating environment 600.

When entering data from collision avoidance system 450, seven ultrasonic ranging transducers 536.sub.i (where i=1 to 7) in transducer array 536a are used, shown in FIGS. 5, 6 and 8. If a given transducer 536 return (echo) shows that an object is within five feet of array 536a, the cell at the indicated location of the return is incremented twice (up to a specified maximum). Also, the probability value assigned to each of the eight neighboring cells is incremented once, to partially take into account uncertainties arising from the 30-degree dispersion angle of the ultrasonic beam generated by array 536a.

In addition, each time a return is processed, all the cells within a cone, which may by way of example, be 10 degrees wide and five feet long (or less if an object appears within five feet), have their assigned values decremented by 1. This erodes objects from the world map that are no longer present and serves to refine the representation of existing objects as mobile robot 18 approaches. Objects are erased from the map at a slower rate than they are entered, so that the path of mobile robot 18 tends to err on the side of not intersecting obstructions.

An example of how data provided by collision avoidance system 450 may be transformed into a mathematical model of one example of an operating environment, such as environment 600, is presented in FIG. 14, where a path 638 from point A to point B, along which mobile robot 18 (not shown) may be directed to follow, is obstructed by two obstacles 640. Other objects 642, 644, and 646 are also positioned within environment 600. A three dimensional probability distribution plot showing the perceived location of nearby objects in environment 600 is illustrated in FIG. 15. The floor area of environment area 600 is represented by cells ("nodes") 650. The probability that any particular cell is occupied by an object is proportional to the upward projection of any cell along the "Z" axis. Techniques for creating world maps of an operating environment or "motion area," suitable for use in the present invention are well known. The world map contains positional information about all the known objects in the environment.

One method for generating the initial world map is to download data into host computer 14, where the data represents the operating environment, and is obtained from CAD drawings such as AutoCAD, a designing program by which any drawing, such as a building floorplan can be reproduced in a microcomputer. A second method is to manually input data into the host computer where the data represents the coordinates of the features of the environment using the MAPEDIT.C subroutine (Appendix 1). A third method for generating the world map is to have mobile robot 18 travel along its anticipated routes and use its sonar system 440 to generate data regarding the features of the environment that are then provided to host computer 14. Also, a combination of all three methods may be employed to create or modify the world model.

The path planner operates on information stored in the world map to determine a route from the mobile robot's current position to its desired destination. The basic search algorithm begins by "expanding" the initial cell corresponding to the mobile robot's current position in the floor map, i.e., each unoccupied neighbor cell is added to the "expansion list." Then each cell on the expansion list is expanded. This process continues until the destination cell is placed on the expansion list, or the list becomes empty, in which case no path exists.

When a cell is placed on the expansion list, a value indicating the direction to the parent cell is stored in the map array. Once the destination cell has been reached, retracing the path consists of merely following the directional arrows back to the source. During this process, only those points representing a change in direction (an inflection point) are recorded. The entire path is completely specified by the straight line segments connecting these inflection points. Details of the path planner are presented below.

The path planner (See Appendix 1, PATHPLAN.C) is implemented as a set of algorithms running on host computer 14 which enables mobile robot 18 to be directed along a calculated path from the present position of mobile robot 18 to a different position, where the positions are defined by Cartesian coordinates. Implementation of the path planner is, by way of example, a modification of techniques taught in: Winston, Patrick Henry, Artificial Intelligence, Addison-Wesley, Reading, Mass., 1984. However, it is to be understood that the scope of the invention may include other implementations of a path planner than those specifically presented herein.

There are four basic tasks the path planner must address in order to direct mobile robot 18 from point "A" to point "B". They are described immediately below with reference to FIG. 16:

1. Finding a path to the destination (point B), hereafter referred to as the "Find-Path" operation at step 800. If no path exists, then this operation returns a value of FALSE to the calling program.

2. Retracing (or backtracking) the path found by the above "Find-Path" operation (discussed more fully further herein) to create a list of straight-line segments describing the route from source to destination, where the source represents the present position (point A) of mobile robot 18. This operation is performed at step 802.

3. Creating the movement commands which are ultimately directed to propulsion module 416 via local processor 402 in order to execute the path. These operations are performed at step 804.

4. If the path is successfully executed, then the path planner program returns a "successful" status from step 806 to the calling program. Otherwise, the program returns to step 800 in order to plan a new path.

Inability of mobile robot 18 to reach its intended destination is usually attributable to obstacles or closed doorways blocking the route. In that case, the planner returns to Step 800 to try to find a different path, using the updated information now encoded in the model.

The path planner includes the following subroutines: Find-Path, Expansion, Backtracking, Path-Execution, Segment-Execution, and Sonar-Mapping. These subroutines are described below.

As mentioned above, the Find-Path subroutine at step 800 is a set of algorithms which implement a modification of an A* search which is described below with reference to FIG. 17. The A* search is a type of search technique which is well known by those skilled in this art and which is taught in: Winston, Patrick Henry, Artificial Intelligence, Addison-Welsley, Reading, Mass., 1984. In the Find-Path subroutine, a mathematical model of the operating environment, also referred to the world map, is provided to this subroutine at step 807. The environment is divided into a definite number of squares. The world map is implemented as a two dimensional array of memory locations, and contains a byte for each square in the environment, such as a room, where the size of a square can range from one square inch up to several square feet, depending on the desired map resolution and the size of the operating environment.

Next, at step 808 two special bytes are stored in this memory array which represents the world map. One byte indicates the present location ("START") of mobile robot 18; the second byte indicates the desired destination ("DEST"). During the A* search process, the host computer 14 looks for the floor cell containing the DEST byte and similarly, during the backtrack process, described below, the computer looks for the START byte.

Next, at step 810, information about the source cell (such as X-Y location, cost, distance traveled, etc.) is put onto a "frontier" list which is a list of points on the outer edge of the search envelope that are candidates for the "expansion" process, described more fully below. Putting the source cell on the frontier list "seeds" the path planner subroutine so that it has a cell to expand. A loop is then entered at step 812 that terminates only when there are no more cells on the frontier list or a path has been found. If the frontier list is empty, then no path is possible and the search fails.

The first step within the loop, at 814, is to find all the cells on the frontier list with minimum cost, and then put them on the expansion list at step 816. The "cost" of a cell is typically some computation of how "expensive" it is for mobile robot 18 to travel to the location represented by that particular cell. The actual cost function used in this implementation is described further herein.

Next, all the cells on the expansion list are expanded at step 818, as described more fully in the next section. If the destination cell is reached, a path has been found and the algorithm terminates with a solution and returns to the calling program from step 820. Otherwise, the loop continues with the new frontier list (updated by the expansion process).

Referring to FIG. 18, the expansion process looks at all the neighbor cells of each cell on the expansion list. Each neighbor cell that is unoccupied and not on either the expansion or frontier list is placed on the frontier list. The details of this are provided below.

A loop is entered at step 822 that terminates when all the cells on the current expansion list have been expanded. If no cells are left on the list, then a value of FALSE is returned from step 824 to the path planner at step 818, indicating that the destination was not reached during the current expansion and that further searching of the updated frontier list is necessary.

The next cell (or first cell if this is the first time through the loop beginning at step 822) on the expansion list is selected. First, a check is made to see if this cell can be expanded. The only cells that can be expanded are those whose corresponding byte in the floor map array is equal to zero. If the value is not zero, this cell may be occupied by an obstacle which has been detected by the robot's sensors. If so, then the value is decremented at step 826 and the cell is put back onto the frontier list at step 828 to be expanded later. This technique enables mobile robot 18 to travel a clear path in preference to a cluttered path, if a clear one exists. If no uncluttered path is found, mobile robot 18 may still be able to traverse the cluttered path. The capability of the expansion subroutine to determine alternative paths enables the robot to find a path even if sonar data provided by sonar system 418 is somewhat faulty.

If the contents of the current floor map cell are zero, then the cell can be expanded. Each of the cell's neighbors may be examined at steps 832, or 834 to see if any of the neighbors are occupied or unoccupied. "Neighbor" in this case refers to the four cells immediately adjacent to the current cell, i.e., located to the north, east, south and west of the current cell. These four "neighbors" may also be referred to as the "4-connected" neighbors. If the neighbor contains the special byte "DEST," then a path has been found at step 832, the X-Y location of the cell is saved at step 836, and a "TRUE" status is returned from step 838 to step 818 of the Find-Path subroutine. Otherwise, if the neighbor cell is unoccupied it is placed on the frontier list at step 840. If it is occupied, it is ignored.

Additionally, each cell has a "cost" associated with it. As in a typical A* search, at step 842, the cost is set equal to the distance traveled from the initial position of mobile robot 18 in order to get to the cell corresponding to the present location of mobile robot 18, plus the straight line distance to the destination cell. This is guaranteed to be less than or equal to the actual total distance from the source cell (present location) to the destination. This particular cost function tends to make the search expand in a direction towards the intended destination, thereby decreasing the search time.

Finally, "arrow" information, used by the backtracking subroutine, described below, is stored in the floor map cell corresponding to the current neighbor at step 846. An "arrow" is one of four values indicating direction, i.e., north, south, east, and west. The arrow indicates the direction to the neighbor's parent, which is the cell currently being expanded.

Control is returned from step 840 to the top of the loop at step 822.

Referring to FIG. 19, backtracking (also called retracing or segmentation) is a subroutine that creates a list of path segments which describe the desired path, based on the contents of the current floor map following the Find-Path operation, as described above. The procedure is very simple. Starting with the destination cell, the steps presented below are performed:

1. Follow the arrow in the current cell to the next cell. Make the new cell the current cell.

2. Return to the program that called the path planner if the new cell contains the value START, indicating that a path to the destination has been found.

3. Return to step 1, above, if the direction arrow of the current cell is the same as the direction arrow of the previous cell.

4. Add the current X-Y coordinate to the path segment list and update the segment counter.

The output of the backtracking subroutine is a list of X-Y coordinates describing the "waypoints" through which mobile robot 18 must pass in order for the mobile robot 18 to reach the ultimate destination.

Referring to FIG. 20, once a path segment list has been found, mobile robot 18 must then physically traverse the calculated path to reach the destination. Each segment of the path is executed individually in a loop beginning at step 860, whereby this process consists of having mobile robot 18 turn to the required heading and then having it travel in a straight line for a predetermined distance.

Control is passed to the segment execution routine at step 870. A status condition is returned from step 871 to step 804 of the path planner, where the status condition indicates whether or not mobile robot 18 was able to successfully execute the segment. If it was successful, then the subroutine proceeds to step 860 where the next path segment (if any) is executed. Otherwise, an error condition is returned from step 871 to step 804 of the path planner.

Referring to FIG. 21, during the execution of a subroutine referred to as "Segment-Execution," the planner performs a number of tasks. First, step 872 sends a command to propulsion module 416 to begin moving forward for a predetermined distance required by the path segment. Next, "Segment-Execution" enters a loop at step 873 which looks for status packets sent back by local processor 402. These consist of one or more of the following:

1. A "move complete" report, indicating that propulsion module 416 has finished moving the desired distance. If this occurs, an indication of successful status is returned by step 874 to step 870, illustrated in FIG. 20.

2. An "obstacle" report, indicating that propulsion module 416 has stopped because an obstacle detected by collision avoidance system 450 impedes its path is returned by step 875 to step 870, illustrated in FIG. 20.

3. A "dead-reckoning" update. The present dead-reckoned position of mobile robot 18 is updated in the world map at step 876.

4. A collision avoidance sonar packet is provided when sonar data is received by local processor 402, at which time the "sonar-mapping" subroutine, represented by the flowchart of FIG. 22, is invoked and the current representation of the world map is updated at step 878.

The loop beginning at step 873 is repeated until either of the steps 874 or 875 within the loop is executed.

Referring to FIG. 22 map sonar is a subroutine that receives the range information obtained by collision avoidance system 450 which then is used to update the local map. Although in the preferred embodiment, range information is obtained by use of ultrasonic transducers 536i, other types of sensors could also be used to acquire such information, as for example, laser or optical range finders.

One of the primary sources of errors with ultrasonic sonars is specular reflection. In order to reduce the number of erroneous sensor readings due to these types of errors, all detected ranges greater than specified distance, which may for example, be five feet, are ignored. Whenever a range reading is five feet or less, the value of the cell at the indicated range and bearing is incremented twice (up to some maximum, as for example, 16), and each of its 8-connected neighbors (all 4-connected neighbors plus each of the diagonals) is incremented once.

During the execution of the map sonar subroutine, sonar range returns or packets provided by processor 532 through local processor 402 to host computer 14 are processed and mapped. The sonar packets are decoded at step 880. Then a loop is entered at step 881 that continues until each range has been processed. At step 882, the range is compared with five feet. If the range is greater than five feet, then processing proceeds to step 884. Otherwise, a transient obstacle will be added to the ma at step 883 by incrementing the appropriate cell (indicated by the current range and bearing) by two, and each of the eight surrounding cells by one. This is the manner in which transient obstacles are added to the map. In step 884, all of the cells in a ten degree cone emanating from the location of the transducer out to the range return or four feet, whichever is less, are decremented by one. In this way, transient obstacles that are no longer detected are gradually erased from the map.

For a mobile robot to be truly autonomous, it must cope with the classic problem of avoiding an unexpected, unmapped obstacle. In the present invention, all collision avoidance sensor information is statistically represented in the world map, based on the number of times that an object was detected at a given cell location [See APPENDIX 1: OA.C and CA.C]. Conversely, when a previously modeled object is no longer detected at its original position, the probability of occupancy for the associated cell is decreased; if the probability is reduced to zero, the cell is again regarded as free space. Transient objects are added to the world map as they are encountered, and subsequently removed from the model later if no longer detected at the same location. Since previously encountered obstacles are recorded in the world map, the mobile robot can avoid them at the planning stage rather than during path execution.

A sample map created in this fashion is depicted in FIG. 15. Free space is represented by an array value of zero and is shown in by the plane coincident with the X-Y plane.

The data fusion system, implemented in software operating in host computer 14, integrates the outputs of fixed security sensor system 12 and mobile security sensor system 19, to obtain a higher confidence solution, and to ensure that the motions of mobile robots 18 through the secured environment do not trigger a system alarm. Referring to FIG. 23, the individual security sensor values are updated as new sensor data becomes available, whereupon a composite threat score is calculated based on the updated sensor data. Data from both fixed and mobile sensors is used to calculate this global composite threat score from individual sensor weightings in order to achieve a high probability of detection with a corresponding low nuisance alarm rate.

The data fusion system "knows" at all times where each robot 18 is located, the zones of coverage for its onboard sensor system 19, and the resultant effect of its presence or motion on that portion of fixed sensor system 12 viewing the same area. This information is incorporated into the world model, representing the area under surveillance, as discussed in greater detail below.

The world model consists of a number of bit-mapped parallel arrays, or layers, each indexed to an absolute X-Y grid representing the floor plan of the secured area (See Appendix 1: OA.C, MAPEDIT.C, and MAKEMAP.C). The floor plan is typically divided up into a number of subset floor plans to achieve a realistically sized model in order to facilitate near realtime manipulation of the encoded information. For any given subset floor plan, the first layer is devoted to X-Y positional information which is used for navigation and collision avoidance, as previously described.

Two additional parallel arrays, or layers, are assigned to the world model and are used to represent the areas of coverage of: (1) the fixed installation security sensors for that portion of the floor plan in which robot 18 is positioned, and (2) the mobile security sensors mounted on robot 18. These two layers are referred to as the "fixed sensor coverage layer", and the "mobile sensor coverage layer".

Since the purpose of robot 18 is to patrol the secured environment, its position and orientation must be considered when calculating the absolute world map representations of the areas within the range of detection of mobile sensor system 19. The representations must be translated and rotated in accordance with the robot's motion. The resulting mobile layer coverage zones can then be fused with those from the fixed sensor layer for those sensors which are triggered, resulting in a "fixed-mobile" correlation factor representative of the maximum correlation between fixed and mobile sensors. This factor is used to calculate the global composite threat.

In summary, the data fusion system (implemented in software) monitors the instantaneous state of each of the fixed and mobile security sensors to determine the presence or absence of an intruder. Local Security Assessment software implemented in local processor 402 onboard robot 18, performs some "local" cross correlation of the outputs on sensor system 19. Results are transmitted over RF link 20b.sub.1 to host computer 14 for further analysis. A higher level ("global") correlation, implemented in host computer 14, then accounts for the outputs of fixed sensor system 12, as well as the outputs from however many mobile robots 18 are operating in the area. This higher level correlation is referred to as Global Security Assessment (See FIG. 33). Each of these assessment functions, local and global, are discussed in greater detail below.

As previously stated, a number of different types of sensors are preferably used onboard each mobile robot 18 (as for example, infrared, microwave, ultrasonic, optical, video, sound, and vibration) to both increase the likelihood of detection and decrease the frequency of nuisance alarms. FIG. 23 illustrates, by way of example, a sample display 890 of video monitor 28 exhibiting the status of the various sensors. Techniques for producing such a display are well known by those skilled in this field of technology. The upper half of display 890 presents the state of each of the mobile sensors, the bearing to a possible intruder, and the current alarm state. Sensors with a darkened background are temporarily disabled or unavailable. The lower half of display 890 is used for displaying robot status information and current environmental conditions.

The motion detection sensors (depicted in the upper half of the display) are grouped into (24) zones. Each zone contains several different types of sensors. Local Security Assessment Software (Section 4.11 herein) performs a summation of weighted scores for all sensors within a particular zone, and calculates a composite threat score (Shown in the upper right of display 890; Refer to FIG. 31) which is proportional to the perceived threat presence. This software is implemented in host computer 14, and presented by way of example in Appendix 1.

The Local Security Assessment Software detects patterns, such as purposeful motion across adjacent sensor coverage zones, and increases the associated composite threat accordingly. The system then activates and positions secondary verification sensors on the robot as needed. At the same time, the current alarm threshold is dynamically calculated, based on the number of sensor groups which are available, and other relevant conditions, such as ambient lighting, time of day, etc. The system classifies an alarm as an actual intrusion only when a complete evaluation has been performed using all sensor groups, and the resulting composite threat score exceeds the alarm threshold.

The Local Security Assessment Software uses an algorithm which employs a polar representation of the sensor data to establish a composite threat score for each of 24, 15 degree, wedge-shaped zones about mobile robot 18, as shown in FIG. 25. The Local Security Assessment Software, provided by way of example in Appendix 2, is written in 6502 assembly language. The human operator is alerted to any situation where the composite threat score exceeds the specific alarm thresholds for a given zone, as discussed in more detail later. A threat assessment value in the range of 0-100 is provided as a quantitative indicator of classification confidence, and a threat vector originating from the robot's current position is graphically displayed by host computer 14 on video display 15.

On each pass through the Security Assessment Loop, (Refer to FIGS. 23-29) individual sensors which are in an alarm condition are identified by the functions `update.sub.-- range.sub.-- sen` and `update.sub.-- onoff.sub.-- sen`, (Refer to FIG. 24; Appendix 1: ACCESS.C) which create an array of output values that are then stored in the current information fields of the data structure. The baseline weighting values for this operation are taken from a two-dimensional array called `init.sub.-- weight`. The previous values are stored in a history file and are pushed onto the top of a data structure called `history.sub.-- info` so as to provide an historical record of a finite period of time, as for example five minutes (See Appendix 1: ASSESS.C and ASSESS.H).

The information stored in the history file is next analyzed by the function `adjw.sub.-- purposeful motion` (Refer to FIG. 26; Appendix 1: SUPPORT.C) for signs of purposeful motion, and the weights for affected sensors adjusted accordingly and stored in an intermediate data structure called `inter.sub.-- weights`. This is accomplished as follows:

1. The algorithm identifies the first active sensor of a given group (i.e., sonar, infrared, microwave, etc.).

2. Data stored in the history file is examined to determine if adjacent sensors of the same group on either side of the active sensor had previously been active within some prespecified period of time.

3. If history of such activity is present, the weight of the active sensor is increased by an increment equal to its initial weight times some scaler S1.

4. In the event an adjacent sensor is found to have been active, the history file is again examined to see if the next sensor in the array also had previously detected motion.

5. If previous motion is again indicated, the weight of the active sensor is further increased by a second increment equal to its initial weight times some scaler S2.

6. This process is then repeated for all other active sensors of the given type, after which the remaining groups of motion detection sensors are similarly examined in kind.

In this fashion, if a temporal history of lateral motion across the field of view of the sensor array is present, such that adjacent sensors are activated in a distinct sequence, the resulting signature is classified as purposeful as opposed to random motion, and the active sensor weight is significantly increased.

Most of the motion detector arrays (microwave, passive infrared, acoustical, optical) are capable of angular resolution only, and provide no range information. An exception is the ultrasonic motion detection system 19f (Refer to FIG. 5) which identifies a potential intrusion through changes in measured target distances as seen by one or more sensors 536.sub.i in the 24-element arrays 536b and 536c. This feature provides an additional level of analysis performed on sonar data accumulated in the history file, in that purposeful motion of an intruder should result in a somewhat continuous path target profile, with no significant discontinuities, or jumps in target position.

The next step in the local security assessment routine is referred to as "cross correlation" (See Appendix 1: SUPPORT.C). This involves checking for correlation among the different sensor groups (i.e., infrared, ultrasonic, optical, etc.) to minimize nuisance alarms. The function `adjw.sub.-- angular.sub.-- sensor fusion` (Refer to FIG. 28) will increase the weight assigned to the output of a particular sensor if another type of sensor also detects motion along the same bearing, plus or minus some specified tolerance. This is accomplished as follows:

1. The first active sensor of a given group is identified.

2 The current value of the sensor weight is incremented by the scaled weight of any confirming sensors of other types which view the same or immediately adjacent areas, and stored again in `current.sub.-- weight`, where: ##EQU1## 3. The adjusted weight values (from `inter.weight`) of the confirming sensors are used for this calculation, as opposed to the initial weights (from `init.weight`).

4. In this fashion, the increase in weighting is proportional to the confidence factor of the confirming sensor.

5. This process is then repeated for all other active sensors of the given type, after which the remaining types are similarly examined.

Once the various weight contributions have been generated for the individual sensors of each type, the function `calc.sub.-- threat` is called to sum the weighted scores to generate a composite threat assessment for each of the 24 zones shown in FIG. 25. For each zone, there exists a predetermined alarm threshold value, and any zone wherein the composite threat exceeds this threshold is assumed to be in an alarmed condition. The video camera 12g.sub.1 will be energized by local processor 402 when the composite threat for any given zone exceeds some scalar (typically 0.6) of the zone alarm threshold. The axis of the most active zone is used to graphically plot a threat vector on a map display of the secured environment, presented on video display 15 (FIG. 31). Head positioning servo 19j (FIG. 4) then is commanded to position video camera 12g.sub.1 so that its optical axis is coincident with the orientation (bearing) of this threat vector. Software for directing the head positioning servo 19j is set forth, by way of example, in Appendix 3. Head positioning servo (panning) systems such as employed in the present invention are well known, commercially available units. Software for implementing the display feature is provided by way of example, in Appendix 1 as INTRUDER.C and INDISP.C. In the event more than one zone is active, the three zones with the highest composite threat scores will generate threat vectors colored red, yellow, and white, in decreasing order of perceived threat severity. Video camera 12g.sub.1, if energized, will always be oriented towards the direction corresponding to the zone having the highest composite threat score, unless manually overridden by a human operator.

The Global Security Assessment Software addresses two fundamental issues: (1) inhibiting those fixed installation sensors which are momentarily activated by the robot's passage through the protected area, and (2) fusing the alarm status data from the fixed installation sensors with the data from the mobile sensors mounted on robot 18 (or robots) in order to create a composite representation of the perceived threat. Flowcharts for software that would be implemented in host computer 14 for performing these functions are provided by way of example, in FIGS. 24-29 and 32-36.

When robot 18 is moving in an area protected by fixed installation sensors, the security assessment system determines when the robot is about to enter or leave the coverage area of any given sensor. The sensor in question must be inhibited for that portion of the time when robot 18 is moving through its field of view, so that the motion of robot 18 does not generate a nuisance alarm. Once the robot has departed the coverage area, that particular sensor must be re-enabled. The robot's X-Y position is used to obtain the identification of all fixed sensors from the fixed sensor coverage layer that could be affected by the robot's motion at that particular instant. These sensors are then gated out when constructing the fixed-mobile correlation factor which is used to calculate the global composite threat. Of course, the robot's mobile coverage layer is time variant while mobile robot 18 is in motion.

The preferred embodiment uses a bit-map approach which determines if any point in the fixed sensor coverage layer lying within in a small area of ambiguity around robot 18 has the appropriate bit set for that particular sensor. Referring to FIGS. 32 and 34, at the beginning of each inhibition loop, the Security Assessment Software must mark all the sensors as uninhibited, then inhibit only those affected by the robot so that when a robot leaves the coverage area, the associated sensor will be enabled once again.

An alternative to the bit-map method is to examine each sensor coverage polygon to see if the robot is within that polygon, then inhibit those sensors affected by the robot's presence. The polygons would be predefined by the operator using the MAPEDIT.C software presented in Appendix 1. The robot is modeled as a point. Consequently, representations of the fixed sensor coverage areas would be expanded by half the maximum dimension of the robot footprint. To determine if the robot is causing a fixed sensor to trip, the position of the robot would be used as an index into the coverage layer. The value of that location in the coverage layer then would determine which fixed sensors would be affected by the robot's presence.

Another alternative to the bit-map approach could be used if robot 18 is modeled as a simple convex polygon (e.g., a rectangle). The Sutherland and Hodgman polygon clipping algorithm can be used to determine whether or not robot 18 is completely outside or partially or completely inside the defined region. [See Sutherland, Ivan, E. and Hodgman, Gary W., "Reentrant Polygon Clipping," CACM, Vol. 17, pp. 32-42, 1974]. This particular technique clips a concave or convex polygon (sensor coverage polygon in this case) to an arbitrary convex polygon (robot). Each sensor area affected by the presence of the robot would be inhibited, and those not affected would be enabled. If both the coverage and robot polygons are convex, then the Cyrus and Beck algorithm can be used. [See Cyrus, M. and Beck, J., "Generalized Two- and Three-Dimensional Clipping," Computers & Graphics, Vol. 3, pp. 23-28, 1978].

In the preferred embodiment, once the fixed sensors affected by the robot have been inhibited, it is necessary to correlate data provided by all of the fixed sensors with each other, as well as with the outputs of mobile sensors on the robot. All sensors are modeled with bit-maps [Refer to FIGS. 35A and 35B}. Data corresponding to outputs of the sensors are integrated with the other maps to form the fixed-mobile correlation factor.

An alternative method of correlating the data may be employed if all the sensors are modeled solely with polygons. Then it would be necessary to determine the specific polygon that is the largest subset of all the active polygons. Another alternative for performing data correlation employs a hybrid scheme. In this scheme, a hit bit-map can be created based on how many polygons cover each cell in the map. Regardless of the method used, it is first necessary to rotate the robot's coordinate system to correspond with that of the fixed sensors.

When the robot is stationary, the data fusion software determines the degree of interaction of the outputs corresponding to sensors on the robot with those of the fixed sensors in the "hit" area in order to develop a composite threat weight. Accordingly, the system first determines the fixed sensors which are active and their associated coverage areas, as stored in the fixed coverage layer. This information then is logically combined with information provided from the calculated coverage areas, in absolute coordinates, of the active robot sensors. The result is stored as the fixed-mobile correlation factor, which is then used to calculate the global composite threat. The fixed-mobile correlation factor represents the maximum fixed intrusion detector threat score corresponding to the fixed intrusion detectors that detect a potential intrusion. The manner in which this calculation is accomplished is discussed in the following paragraphs.

To initially set the appropriate bits in the fixed sensor coverage layer, the coverage extents are defined using the Map Editor (Appendix 1: MAPEDIT.C). A standard polygon scan conversion algorithm [See Rogers, David F., Procedural Elements For Computer Graphics, McGraw-Hill Book Company, New York, 1985] sets the correct bit for that particular sensor upon program start-up, where an assigned bit corresponds to each fixed sensor [Refer to FIG. 32 and Appendix 1: FIXEDSEN.C].

The mobile sensor coverage layer associated with the robot is created when needed to fuse data between the sensors of fixed sensor system 12 and sensor system 19 on robot 18. The information on robot heading and X-Y position is first obtained from local processor 402, and then the mobile array values are generated according to preestablished rules described below. By way of example, the preferred embodiment employed a 8-bit representation. The position and orientation of the robot is "frozen" before calculating the array values. Again, a standard polygon scan conversion algorithm (implemented by POLYFILL.C, set forth in Appendix 1; See also Rogers, David F., Procedural Elements For Computer Graphics, McGraw-Hill Book Company, New York, 1985) is used to set the appropriate bits for the X-Y locations in the array up to the imposed extents, which are defined below.

For example, the range of microwave motion detector system 19d may be constrained by the room boundaries, as might be vibration sensor 19b. Ultrasonic motion detector system 19d may be constrained to where all bits are set within a circle of ambiguity of some pre-specified diameter, centered at the reported range value of the disturbance along the appropriate bearing. The limits on an acoustical coverage area could be defined as a wedge of some specified angle of uncertainty along the calculated bearing line, out to a distance constrained by the room or map boundary.

When a global correlation (correlating the outputs of both triggered fixed and mobile sensors) is desired in a static scenario, host computer 14 sets all the appropriate bits in the mobile layer for sensor system 19 according to the robot's current position and heading. [Refer to FIG. 35A]. In essence, this effects a coordinate transform which makes the mobile sensors look like fixed sensors for that instant in time. Then, host computer 14 determines which sensors are alarmed, and begins to generate the fixed-mobile correlation factor using the sensor coverage information encoded in the fixed and mobile sensor layers. The fixed-mobile correlation factor is used as one of the components in calculating the global composite threat.

An alternative method of correlating the outputs of both triggered fixed and mobile sensors is to find the largest polygon completely contained within all the other active polygons, i.e. find the largest subset that is a subset of all other subsets. This is most easily accomplished using the following steps: Pick an initial polygon (any one will do). Pick another polygon that has not been clipped. Clip the two polygons against each other, resulting in a third representing the intersection. Using the resulting polygon as the initial polygon, repeat the process until all polygons have been clipped. The output is the maximum size polygon contained within all the other polygons. If all polygons are guaranteed to be convex, then the Cyrus and Beck clipping algorithm can be used. Otherwise, each convex polygon must first be decomposed into two or more convex polygons, then clipped. Alternatively, a more general algorithm capable of clipping a concave polygon against another concave polygon could be used. [See Weiler, Kevin, and Atherton, Peter, "Hidden Surface Removal Using Polygon Area Sorting," Computer Graphics, Vol, 11, pp. 214-222, (Proc. SIGGRAPH 77), 1977].

As an example operational scenario, mobile robot 18 is assigned a patrol route (or a discrete location) by the operator. The path planner calculates an appropriate path, whereby mobile robot 18 assumes its first assigned surveillance position. All primary detection sensors are online (optical, acoustical, infrared, vibration, and microwave) and RF data link 20 is in standby operational status. Video camera 12g.sub.1 and associated RF video link 20b.sub.2 are deactivated.

If a possible disturbance is detected by one of the fixed installation motion detectors of fixed sensor system 12, an appropriate signal is provided via AIU 16 to host computer 14. The human operator is alerted by an audio beep from alarm system 22. In one type of scenario, host computer 14 may determine that the triggered sensor could not have been set off due to the motion of mobile robot 18 by noting that the current dead-reckoned position of the robot is not within the designated coverage area of the alarmed sensor. The Path Planner Software then dispatches robot 18 to a location where mobile sensor system 19 can observe the area in question. With no additional confirmation from mobile security sensor system 19, the Realtime Assessment Software, after a designated period of time, classifies the threat as a nuisance alarm. All fixed and mobile sensor reports are continuously time stamped and logged to disk in host computer 14 for later replay and analysis. The robot then continues its assigned patrols.

In another example of a typical operational scenario, a second disturbance is later detected by another sensor of fixed security sensor system 12. The robot is dispatched to the area and assesses the situation. In this example, however, the primary mobile detection sensors also react in confirmation. The threat level is sufficient for the software to activate secondary sensors, and the ultrasonic motion detection system 19f is enabled. Cross correlation between sensors shows a strong likelihood of an intruder at position (X,Y) on the map of the secure area, as indicated in the lower half of control screen 890 (FIG. 31) of video display 15. The software which assembles this data and presents it on control screen 890 is provided, by way of example, in Appendix 1 as MAP.C, INDISP.C and INTRUDER.C.

The Realtime Assessment Software activates video camera 19h onboard the robot. The camera is automatically positioned along the bearing of the disturbance by head positioning servo 19j. The human operator is notified by a second audible alert, while video motion detector system 12g surveys the scene under surveillance. If the motion detected by video camera 12g.sub.1 confirmed as an actual intrusion, alarm system 22 provides an audible output. The human operator is able to observe the intruder on video monitor 28, and may optionally see the (X,Y) position of the intruder depicted in a floor plan map, displayed on video display 15 by host computer 14.

Once the relative bearing to an intruder has been established, the bearing can be used to calculate a motion command which causes mobile robot 18 to rotate in place until the intruder is directly ahead of the robot, centered on the axis of the collision avoidance system 450. Range information gathered by collision avoidance system 450, normally used to avoid an object in the path of the robot, provides information used to direct the robot towards the intruder and to follow him. The robot's mean forward velocity is adjusted as a function of range to the intruder, and a calculated differential in left and right drive motor speeds is introduced as a function of how far off centerline the target appears. This differential causes the robot to turn towards the target being followed in a controlled fashion, until it appears centered, all the while maintaining a specified distance interval. The robot's absolute X-Y position is graphically displayed on a map of the secured area, while camera transmits live video to display 890 for evaluation by the operator.

Unless otherwise indicated all software is implemented in host computer 14. Program listings set forth in Appendix 1 are written in "C" and are provided by way of example only. Program listings set forth in Appendices 2 and 3 are written in 6502 assembly language and are provided by way of example only. The software listed in Appendix 2 is implemented in local processor 402. The software listed in Appendix 3 is implemented in the processor of video motion detector system 12g.sub.1. The scope of the invention includes all modifications to such software as would be evident in light of the appended teachings. Furthermore, the scope of the invention includes software written in languages other than those set forth herein.

Obviously, many modifications and variations of the present invention are possible in light of the above teachings. For example, the scope of the invention includes the employment of one or more mobile robots 18 to patrol the secured environment. Therefore, singular references to mobile robot 18 are to be understood as referring to one or more mobile robots 18. Therefore, within the scope of the appended claims, the invention may be practiced otherwise than as specifically described. ##SPC1## ##SPC2## ##SPC3##