Control-based event-driven bandwidth allocation scheme for video-surveillance systems

ABSTRACT Modern computer systems consist of large number of entities connected through a shared resource. One such system is a video surveillance network consisting of a set of cameras and a network manager. The surveillance cameras capture a stream of images, encode them with a quality factor and transmit them to the manager over a shared constrained network. The central manager allocates bandwidth to the cameras in a fair manner using a threshold based game-theoretic approach. The presence of these multiple control loops that interact with each other leads to complexity in providing performance and safety guarantees. Our previous work explored performance of the event-based manager using model checking to verify relevant properties of linear models. In this paper we build on our previous work by verifying complex camera models that capture uncertainties during image capture. We model the uncertainties using probabilistic Markov Decision Processes (MDPs) and verify relevant properties of the system. We also evaluate system performance for different system parameters with varying triggering thresholds, showing the advantage of model checking for safe and informed parameter selection. Finally, we evaluate the effect of varying thresholds on manager interventions by capturing images on a commercial off-the-shelf (COTS) camera test-bed.

like stability, convergence, number of manager interventions and number of dropped frames [8].
We use a probabilistic model checker PRISM [9], to verify different properties of the system by including probabilistic disturbances in the camera model. We also show that using Statistical Model Checking (SMC) helps to reduce the impact of state-space explosion at the expense of relaxed guarantees on system performance.
The contributions of this paper are as follows: • Realistic camera model implementation by incorporating dynamics that arise during image capture • Comparison of system behavior with varying camera parameters for model with disturbances • Evaluation of statistical model checking of the camera network with relaxed guarantees • Expanded experiments on the real camera network with larger number of cameras for larger number of triggering thresholds This paper expands on the results from [8] in several directions, both from the model checking (theoretical) perspective and from the implementation (practical) standpoint. On the theoretical side, we verify properties of probabilistic camera models using both classical model checking and statistical model checking. On the experimental evaluation side, we analyse system performance for a larger number of triggering thresholds of the event based manager. Finally, the paper also analyses the effect of threshold selection on the number of manager interventions and frames dropped by the cameras. Paper Organisation: The rest of the paper is organised as follows. First we introduce the camera network architecture in Section 2 and discuss the behaviour of the cameras. The section also describes the two different triggering strategies of the network manager. Section 3 gives an introduction to model checking and describes the different types of model verification. Section 4 describes the implementation of the camera network in PRISM [9], the model checking tool used in this paper. Sections 5 and 6 discuss the results obtained using model checking and the camera test-bed respectively. Finally, we discuss related work in seven and conclude the paper in Section 8.

System model
This section describes the architecture and modelling of the camera surveillance network. We also introduce the notation used in the remainder of the paper in this section.

System architecture
The system consists of a set of cameras connected to a central manager via a shared Ethernet network. At each time instant t, we define a set of active cameras C t ¼ fc 1 ; . . . ; c n g where n is the number of active cameras. Each camera in the network captures a stream of images, encodes, and transmits them to the network manager. The camera encodes each image ensuring that the resulting frame size is less than or equal to the bandwidth allocated by the network manager. The manager allocates bandwidth to all the cameras in the network at each instant it is invoked. Bandwidth allocation to all the cameras is the network is recalculated by evaluating the camera requirements and its relative error compared to other cameras in the network.
The architecture enables the use of two independent control strategies to achieve a good match between the resource allocated to each camera and their resource consumption:.
• Image fitting at camera p: To fit a frame w to the allocated bandwidth, B p;w , by choosing the appropriate image quality, q p;w .
• Bandwidth allocation at the manager: The amount of bandwidth to allocate to each of the cameras while ensuring it does not exceed the total amount of available bandwidth H. Figure 1.: System Overview Figure 1 shows an example of the camera network with four cameras, ðc 1 ; c 2 ; c 3 ; c 4 Þ connected to the network manager through a router. The unidirectional blue arrows denote the control signals sent from the manager to the cameras. The control signals contain information about the amount of bandwidth allocated to each cameras and their appropriate communication slot. The black arrows denote images sent from the cameras to the network manager over the shared Ethernet connection.
The manager enforces bandwidth restrictions for each camera using flexible time-triggered Switched Ethernet (FTT-SE) [10]. FTT-SE dynamically allocates Ethernet bandwidth to all the cameras independently and frames that are larger in size compared to the allocated bandwidth are dropped.

Camera behaviour
The cameras in the network capture a set of frames and encode them using the chosen encoding technique (In this paper, we use Motion JPEG (MJPEG)). The images are then transmitted to the manager over a common Ethernet connection during each transmission period. Figure 2 shows an original image and an image after encoding it with a quality factor. The original frames captured by the camera consist of redundant information and are unsuitable for direct transmission. Most encoding techniques use a quality factor q p;w to encode images and reduce the amount of redundant information contained. Higher values of q p;w leads to frames of larger sizes with fewer artefacts. Motion JPEG (MJPEG) generally has quality factor bounded such that q p;w 2 ð0; 100�.
The camera generates a frame of size s � p;w as shown in Equation 1. s p;max is the estimated maximum frame size that is dependent on the number of pixels in the image. The frame size is then saturated to set global limits for the maximum and minimum frame sizes. δs p;w indicates the stochastic disturbance that occurs due to changes in the scene being captured such as movement, illumination, number of people in frame to name a few. ŝ � p;w ¼ 0:01 � q p;w � s p;max þ δs p;w ; (1) ŝ p;w ¼ maxfs p;min ; minfs p;max ;ŝ � p;w gg: (2)

Figure 2 Camera Encoding
The camera frame size controller is synthesised using Equation 2. The frame size s p;w is determined by regulating the quality q p;w with a simple PI controller. The controller minimises the error e p;w , between the allocated bandwidth B p;w , and the resulting frame-size s p;w as shown in Equation 3. e p;w is then normalised, limiting the error between −1 and 1 in most operating conditions. This control design achieves a zero-steady state error (when δ ¼ 0) ensuring that the size of the encoded frame is equal to the amount of bandwidth allocated by the manager. The quality parameter q p;w is the control signal for the camera controller and it roughly corresponds to a compression level of the frame. The values of k p and k i are the proportional and integral gains of the camera controller respectively.

Manager behaviour
The network manager M acts on a global scale deciding the optimal bandwidth to allocate to the cameras C t connected in the network. The manager also ensures that the total allocated bandwidth does not exceed the fixed capacity H of the network. M selects the bandwidth allocation vector b �;w at each instant t that it is invoked such that, Each element of b �;t determines the fraction of the bandwidth assigned to the respective camera in the network. The bandwidth assignment is done periodically during each allocation period. Equations (7) and (8) form the core of bandwidth calculations in the manager. B p;w denotes the amount of bandwidth allocated to camera p for frame w which is a function of the b p;t M; w, the fraction of bandwidth (between 0 and 1).
If the frame size is greater than the amount of bandwidth allocated, i.e. s p;w > B p;w , the frame is dropped as it is outdated and the corresponding transmission slot is lost.
The fraction of bandwidth allocated to each camera is calculated using Equation 8. λ p;t 2 ½0; 1� denotes the relative importance of camera c p in the network and the extent of bandwidth reallocation by the manager. ε is a constant that limits the change in bandwidth trading off between the responsiveness of the manager and its robustness to disturbances.
The matching function f p;t determines a match between the frame size s p;w and the allocated bandwidth B p;w for the w-th frame of camera p. In the current implementation, the matching function is chosen to be the same as the normalised error used in the camera given by Equation 3. In order for the system to adhere to properties such as starvation avoidance, balance, convergence and stability, the matching function has to satisfy the following properties: ( The manager is triggered with either a time-triggered or an event-based strategy. The time-triggered manager is activated periodically with period π M , a multiple of π alloc , the allocation period. At time 0 the manager divides the available bandwidth among the cameras equally. The following network manager interventions, happening at times fπ M ; 2π M ; 3π M ; . . .g, assign the bandwidth based on the relationship from Equation 8. This triggering strategy has some drawbacks. Triggering the manager has a computational overhead with linear complexity on the number of cameras. The choice of π M is also non-trivial. Choosing a small value of π M invokes the manager too frequently causing constant bandwidth reallocation. On the other hand, a large value leads to slow reactions to changes in the scenes captured by the cameras.
An event-based manager reallocates bandwidth only when necessary, avoiding frequent bandwidth recalculations [8]. We formulate the following rules to ensure the event-based manager reacts to changes in the network.
• C t À �C t . When the number of cameras in the network changes. The manager starts by allocating equal amount of bandwidth to all the cameras and then proceeds to allocate bandwidth depending on the threshold and calculates it using on Equation 8.
• ð9c p s:t:τ thr < je p;w t jÞ^ðt mod π alloc ¼ 0Þ. When all the cameras have finished transmission and a camera has an error greater than the absolute value of the threshold τ thr .
The system allows cameras to dynamically join and leave the network. For convenience Tables 1 and 2 give the summary of terms used in this paper.

Model checking
This section gives an introduction to model checking and the two models used for verification. First we discuss the modelling checking methodology and describe the two camera models constructed. Then we define the different camera properties constructed for evaluation and model parameters used for system evaluation.

Model checking introduction and motivation
Cyber-physical systems and communication networks are growing in complexity. This rapid growth also increases the presence of errors and makes the reliability of these systems a critical issue. Model checking has shown promise in detecting errors and providing guarantees in large scale cyber-physical systems.
Traditionally, software testing has been the dominant methodology to verify software systems. However it has the drawbacks of being a time consuming, complex, and costly procedure. In some cases testing is not feasible due to the inability to cover all test cases. In general, model checking is a more powerful  Threshold that triggers the manager tool compared to testing as it uses a model and provides more useful information about system behaviour.
Hardware systems have high manufacturing costs, and therefore it is crucial to catch design errors early. Hardware correctness is generally verified using emulation and simulation. Similar to software verification, exploring all the possible input combinations and verifying all outputs is often not feasible. Model checking can be used in both these scenarios.
Model checking is used to verify certain properties of a system model. In model based verification, the models are described in a mathematically precise way. Systems are modelled as Markov chains and verified using existing model checking and verification tools, some of which are PRISM [9], SPIN [11], UPPAAL [12].
Model checking also makes it possible to generate strategies for optimal operation of the modelled system while subjected to required constraints. This strategy of operation depends on precise modelling of the system. It is therefore important to eliminate any ambiguities or incompleteness in the model but include non-determinism and a characterisation of the uncertainty. Figure 3.: Model Checking Methodology Figure 3 shows the general work-flow of applying model checking for property verification. The system model represents the functioning of the system as an MDP consisting of states and transitions. System property is the required behaviour of the system that is evaluated. The surveillance camera network model and properties are explored in sections 3.2 and 3.3 respectively.

Figure 3 Model Checking Methodology
Probabilistic Model Checking (PMC) involves modelling of systems with stochastic behaviour and the verification of properties of such systems. In PMC, systems are modelled as state-transition systems where transitions between the different states are decided by probabilities. Discrete-Time Markov Chains (DTMC), Markov Decision Processes (MDP) and Probabilistic Timed Automata (PTA) are some of the models that support probabilistic transitions. The properties to be verified are expressed using probabilistic temporal logic, such as probabilistic reward computation-tree logic (PRCTL) [13]. The camera surveillance network is modelled using Markov Decision Processes (MDP).
A MDP is a 4-tuple ðS; A; P; RÞ, where S is a set of finite states, A is a set of actions, P : ðs; a; s 0 Þ ! fp 2 Rj0 � p � 1g is a function that encodes the probability of transitioning from state s to state s 0 as a result of an action a, and R : ðs; a; s 0 Þ ! N is a function that encodes the reward received when the choice of action a determines a transition from state s to state s 0 .

Deterministic vs probabilistic models
Deterministic models are simple system representations that do not contain any probabilistic transitions between the different states in the system model. The probability P, from each state s to the next state s 0 of the system MDP, is equal to 1. Deterministic models also have a single outgoing transition from each state. This simplifies property verification and allows verification of larger number of sub-systems in the system model. These deterministic models are traditionally suited for verification of simple systems that do not show any stochastic behaviour [14].
However, these simple models do not capture stochastic behaviour that is generally present in real-life systems. Uncertain and unreliable behaviour in systems arises due to inherent system properties such as randomised communication algorithms, coin tosses, dice rolls with random outcomes and so on. Uncertainty in systems can also arise due to the presence of adversaries attacking the system. Uncertainty in systems can also manifest as stochastic variance in system variables such as disturbances during image capture, packet drops in network communication and so on.
This uncertainty can be modelled by attaching probabilistic distributions to the different transitions in the system model. Probabilistic models allow multiple probabilistic transitions from state s to the next state s 0 while ensuring the sum of all probabilities from a single state sum to 1. For example, a fair five sided die can be modelled through the transition from the initial state to the result of the die with five transitions, where each transition is attached a probability of 1=5 ¼ 0:2. Similarly, a fair six sided die can be modelled using a coin toss to prevent probabilistic imbalances arising due to divisibility problems [15].
Modelling of probabilistic systems requires expert knowledge about the system compared to simple deterministic models. The complexity present in probabilistic models also leads to the problem of state space explosion [16,17] and hinders the size of system built for verification. However, due to their large application possibilities, probabilistic models have been used for verification of systems successfully in various industrial settings [18].
Uncertainties in the camera network model arise during image capture due to sudden disturbances due to movement, changes in lighting and various other factors [3]. These disturbances are captured by the factor δ in Equation (1). Previous work [8] considered a linear relationship was considered between quality and frame size and did not consider the disturbance δ during system verification. Although this was a simplification of the modelling, it was useful in proving certain properties of the system. This paper considers the disturbance δ through probabilistic transitions in the camera model.

Property verification
The characteristics of the system that is being verified are modelled as properties using formal language. The properties are modelled using precise mathematical equations and checked for the presence of appropriate states and paths in the state-space. The different properties are classified into Qualitative and Quantitative properties. Qualitative properties evaluate definite state reachability or full probability of the property. For example, P �1 ½G H alloc ¼ H�, where H indicates the total amount of bandwidth available and H alloc indicates the total amount of bandwidth allocated to all the cameras connected in the network. G denotes that the property is checked globally. The property checks for complete bandwidth allocation with a probability of 1.
Quantitative properties evaluate whether the system reaches a state or exceeds a property with a threshold. They are framed similar to qualitative properties with a relaxed probability requirement. Considering the same PRTCL property as above, P � 2 3 ½G H alloc ¼ H� relaxes the previous strict probability to 2 3 . The relaxed bound simplifies property verification and accommodates larger model sizes.

Classical vs statistical model checking
Model checking tools construct the whole state-space by building states and transitions, and storing it in memory. These tools have an upper limit on memory usage to limit runoff programs, restricting the size and complexity of system models. Classical model checking builds the whole state-space irrespective of the presence (or absence) of probabilities in transitions. Probabilistic models capture complex behaviours of the system but are larger in size in comparison to deterministic models. This state-space explosion causes memory issues during verification of complex system models.
Statistical model checking (SMC) [19] performs Monte Carlo simulations of the system with stochastic behaviours. SMC simulates the system for a finite number of runs and applies techniques from the area of statistics to evaluates it for property verification (or failure). These Monte Carlo simulations of the system provide estimates on the probabilistic measure on executions. SMC provides relaxed bound on system performance useful for verification of large complex systems, where classical model checking fails due to memory limitations [17].

Strategy generation
Strategy generation in a probabilistic system selects an optimal action or state transitions to resolve non-deterministic choices and maximise rewards (or minimise cost). PRTCL reward minimisation operator R r min¼? selects a strategy that resolves r where r is the reward.
For example, R r min¼? ½F ϕ� minimises the total reward r along paths that leads to state satisfy the state formula ϕ. In the camera network, some relevant strategies are 'minimise the number of manager interventions', 'minimise the total number of dropped frames', 'minimise a defined cost' or maximise the bandwidth utilisation'. Strategy generation is considered to be out of scope of this paper.

System implementation
This section describes the modelling of the camera surveillance system and disturbances during image capture using PRISM model checker. We also describe the construction of different camera properties and model parameters used for model checking.

System modelling
The different entities of the system are modelled as a set of modules in PRISM. In the camera network model, the different modules are namely the manager, the scheduler and the cameras. The cameras are modelled identically to each other but have their own independent modules. The scheduler is introduced into the camera model to determine the order in which the different modules in the system are invoked. This module is necessary as the network manager is modelled to act only when required in an event-based manner. The camera modules are scheduled in a turn-based manner and then the scheduler evaluates the necessity of invoking the event-based manager. An example schedule is show below. The scheduler invokes the manager and all the cameras in order during Turns 1 and 2. Turn 3 shows a scenario when the cameras have reached equilibrium (the frame sizes match the allocated bandwidths) and the manager is not invoked. It is invoked again during Turn X when the allocated bandwidth requires recalculation.

Disturbance modelling
Disturbances occur in the camera due to changes in the scene captured by the camera. Equation 1 models the behaviour of a camera with disturbances where δ denotes the disturbance. This uncertainty is modelled in PRISM using probabilities on the different transitions. The camera module is composed of two different formulas for calculation of the frame size. The first formula considers the value of δ to be 0. The second formula includes δ during frame size calculations and results in a frame of larger size. The current model assigns a probability of 0.7 to the linear formula and 0.3 to the formula for frame size with disturbances to ensure that the total probability is 1.

Properties
Model checking involves verifying relevant properties of a given system model. These properties are generally the desired/undesired behaviours of the model. Real-life requirements are converted to formal language and input into the model checker as shown in figure 3. The following properties for the camera model are verified (1) Convergence: Convergence is defined as 'nothing happens in the model after some time' for model checking. The PRCTL formula above returns the minimum probability P min of the model finally F, globally G such that no changes occur in the system !ðany change eventÞ. !ðany change eventÞ is a variable that records changes in the bandwidth allocations and can be used as a measure to gauge if the system has converged.
(2) Number of Resource Manager Interventions: This property is used to quantify the number of manager interventions during one verification run of the model. The reward operator R rm calls max here counts the maximum number of resource manager calls rm calls finally F after a certain number of rounds max rounds have passed.
(3) Number of dropped frames: Similar to the previous property, this property quantifies the number of dropped frames. The reward operator R dropped frames max counts the maximum number of dropped frames dropped frames, finally F after a certain number of rounds max rounds have passed.
(4) Total cost: total cost calculates the cost incurred by a triggering policy, i.e. a chosen threshold. The property is tuned differently depending upon actions that are penalising to a system. For example, dropping of frames, manager interventions, or addition/deletion of new cameras affect the camera network differently dependent upon the configuration of the system. In this paper, we penalise dropped frames and manager interventions by 10 and 1, respectively. In PRISM this can be defined as total cost ¼ 10 � dropped frames þ 1 � rm calls.

Model parameters
The performance of the system is evaluated with respect to different parameter values using model checking. This enables faster parameter evaluation and tuning with varying disturbances in the model. For the camera system the following parameters are considered, ε is the scaling factor that denotes the aggressiveness of the system. It is a trade off between responsiveness and stability of the manager. Higher values of ε increase convergence speed of the system but may cause overshoots, whereas small values of ε result in a slower but more stable behaviour during network re-configurations. In the current model, ε is set to 0.5. λ 2 ð0; 1Þ denotes the importance of the camera in the network. When λ ¼ 0, the network manager does not reallocate bandwidth to the camera and the onus is on the camera to adjust its bandwidth without manager interventions.
When λ ¼ 1, the network manager adjusts the bandwidth allocated to the camera at a higher rate with no quality changes expected from the camera. This methodology grants the architecture the ability to incorporate multiple types of cameras in the same network. For example, if camera c p is incapable of changing it encoding quality, then λ p is set to 1.
The triggering threshold τ thr 2 ð0:1; 0:9Þ, determines the activation of the manager for network re-configurations. The choice of τ thr is non-trivial and is discussed in detail in [8]. Small values of τ thr lead to quicker manager activation but cause higher number of network re-configurations. Large values of τ thr reduce the number of manager interventions and network re-configurations at the cost of information loss. k k;p and k i;p are the proportional and integral gains of camera p that determine the aggressiveness with which the camera regulates its quality. Large controller gains generally lead to faster camera adaptations and larger quality changes.
τ thr and k i;p are analysed in more detail in the following sections.

Verification results
This section discusses the verification results for the camera models built in PRISM. The section also shows the state-space evolution and property verification results for the two different types of the model. Model I: The first model of the camera system describes the system with no probabilities. The camera modules use a linear equation to derive the frame size ŝ p;w given a quality q p;w . Equation 1 with δ ¼ 0 disregards the effect of disturbance during image capture. This simplification in frame size calculation results in a smaller state-space that enables performance evaluation of a larger number of cameras. Model II also provides stronger property verification guarantees using classical model checking compared to Model II .
Model II: The second model of the camera network incorporates disturbances during image capture as probabilistic transitions. The probabilities are added during the frame size calculation as shown in Equation 1. A realistic model of the camera model is realised using two independent equations. The first equation is linear and already described in Model I. A high probability is attached to this equation. The second equation generates a larger frame size ŝ p;w for a given quality q p;w compared to the linear equation. A lower probability is attached to this equation. The probability distribution models the scenario in which disturbances occur in the generated frames. Table 3 shows the evolution of the size of camera state-space. The camera and manager modules are modelled in minimal number of states while capturing the relevant behaviour of the physical camera network. The system also imposes an upper limit on the number of frames transmitted to the manager to ensure convergence of property verification. Without the limit, the state space grows infinitely and makes model checking impossible due to its infinite size.

Classical model checking results
Model I without probabilities grows at a lower rate compared to the model with probabilities, Model II. PRISM is unable to build the model of the camera network with probabilities due to memory limitations for Model II with the number of cameras larger than 5.

Deterministic model results
The subsection analyses the impact of controller gain k i on the performance of the camera model without disturbances. Figure 4 shows the effect of k i on the percentage of frames dropped by the manager due to bandwidth restriction violations. The plot on the left shows the percentage when controller gain k i is 5 and the right plot when k i is 25, for an increasing number of cameras. There is a very low percentage of dropped frames when the number of cameras in the network is 2, 4, 5 and 10 due to floating point calculations leading to quicker convergence of bandwidth calculations. The frames are dropped mostly during network initialisation and initial regulation of camera quality. This is transient  Figure 4 Percentage of Dropped Frames for Model I phase of the camera network as the total amount of available bandwidth is lower than the ideal bandwidth required for each camera. This causes quality q p regulation in camera frame sizes. If the current frame size, s p;w is greater than the amount of bandwidth B p;w allocated by the manager, then the frame is dropped. Larger k i leads to faster bandwidth adaptation and convergence, leading to fewer dropped frames. Figure 4.: Percentage of Dropped Frames for Model I

Probabilistic model results
Adding probabilities to the model increases the size of its state-space as shown in Table 3. This increases the complexity of property verification due to the large state-space. PRISM is unable to build models with large number of cameras due to memory issues resulting in a reduced number of cameras to 5. Figure 5 shows the percentage of dropped frames for two values of controller gain k i . Having a low value of k i , causes a frame drop greater than 75% while using a gain of higher value reduces the dropped frames. It is also seen that the amount of dropped frames is higher for Model II compared to Model I. This is due to the presence of dynamics in the model giving a more complex analysis of the system. Using a probabilistic model in combination with model checking enables choosing controller parameters using more detailed information.
There is also faster convergence for a particular number of cameras as seen in the previous experiment. Figure 5.: Percentage of Dropped Frames for Model II

Statistical model checking results
Statistical model checking allows verification of an increased number of camera modules with disturbances using model II. Compared to classical model checking, statistical model checking is able to build state-space of the camera network with 20 cameras instead of 5. Figure 6 shows the effect of threshold, τ thr on the percentage of dropped frames by the cameras. The percentage of dropped Higher values of k i lead to reduced number of dropped frames for all thresholds due to faster camera adaptations. Increasing τ thr does not increase the number of dropped frames as the cameras regulate their bandwidth utilisation quicker. There is faster convergence for values 4, 5, 10 and 20 due to divisibility and model building convergence. We do not apply SMC to the linear camera model, Model I, as the state-space of the model is smaller in size and classical model checking provides more robust bounds on property verification. Figure 6.: Percentage of Dropped Frames for Model II using SMC

Experimental results
This section describes the experimental results obtained using the camera testbed. First, we provide context for the experiment by describing results from our previous work [8]. Next we discuss costs obtained for varying triggering thresholds τ thr with experiments conducted to evaluate the number of dropped frames and manager interventions.

Experimental setup
The camera network is composed of multiple cameras and a network manager connected through local Ethernet. The multiple units of the network are implemented on a PC with Intel Core i7-4790 8 core CPU with 32 GB RAM. The current implementation of the network consists of three off-the-shelf Logitech C270 cameras. The experiment has the following setup: • Proportional Gain: k p;1 ¼ k p;2 ¼ 10 • Integral Gain: k i;1 ¼ k i;2 ¼ 0:5 • Minimum Quality: q 1;min ¼ q 2;min ¼ 15 • Maximum Quality: q 1;max ¼ q 2;max ¼ 85 • Camera Importance: λ 1 ¼ 0:7, λ 2 ¼ 0:3 • Scaling Factor: ε ¼ 0:4 The total network bandwidth is constrained to ensure camera adaptation.

Results
Previous work [20] describes the results for camera adaptation with timetriggered manager. Similarly [8], investigated the implementation of a eventtriggered manager. This paper builds on the previous experimental results by examining the operation of the event-triggered manager for a larger number of threshold values.
Recall that there are two control strategies: • The network manager, that decides the amount of bandwidth to be allocated to each of the cameras • The camera, that adapts its quality to fit the frame to the allocated bandwidth [20] described the camera adaptation using control theory and also showed the advantage of co-operation between the network manager and the cameras work to ensure optimal network utilisation [8]. Improves on the work by showing a need for triggering the manager only when required and the non-trivial decision involving the optimal selection of the triggering threshold, τ thr . Figure 7.: Results with Equal Distribution, and adaptation with [10] (left plots) and PI controller (right plots) [20] In this experiment, the manager allocates an equal amount of bandwidth to the two cameras in the network to evaluate camera adaptation. The network manager allocates bandwidth to the cameras periodically with game-theoretic bandwidth allocation. Figure 7 shows the comparison between two adaptation schemes, one from [10] and the adaptive PI controller from previous work [20]. Only camera 1 is Figure 7 Results with Equal Distribution, and adaptation with [10] (left plots) and PI controller (right plots) [20] present initially up to time 40 s, then camera 2 joins the network. Camera 2 leaves the network at around time 80 s.

Time triggered manager
The left plot shows the adaptation strategy from [10] with a frame size estimation model to fit image sizes to the allocated bandwidth. The right plot shows the camera with a tuned PI controller. The parameters of the camera controller are tuned empirically according to standard control practices [21]. The PI controller is more efficient at using the bandwidth allocated by the network manager compared to the model from [10]. The combination of timetriggered bandwidth allocation and camera adaptation using PI controller is efficient in bandwidth allocation and its utilisation by the cameras. Figure 8.: Event-triggered activation with τ thr 2 f0:1; 0:2; 0:3; 0:4; 0:5g and the optimal strategy synthesised by PRISM: bandwidth allocation (b 1 and b 2 ) and image quality (q 1 and q 2 ) [8].

Event-triggered manager
The event-triggered manager is designed to be more efficient compared to the time-triggered manager. It is only triggered when the absolute error in the cameras exceeds τ thr . Figure 8 shows the event-triggered manager triggered at different thresholds. Both cameras are initialised in the network simultaneously at time 0. Camera 1 captures a scene that contains a large number of artefacts and thus requires a larger allocation of the bandwidth. Camera 2 captures a simple scene with fewer movements and artefacts requiring a comparatively smaller bandwidth allocation. The manager allocates a larger amount of bandwidth to camera 1 and lower amount of bandwidth to camera 2 as seen in the figure. Thus, selecting the value of τ thr becomes a crucial design choice to optimise performance of the camera surveillance network.

Choice of triggering threshold,τ thr
The cost function chosen in the paper is defined as shown in Equation 6.5, where man int is the number of manager interventions and drop1, drop2 and drop3 are the number of dropped frames of camera 1,2 and 3, respectively. Figure 9 shows the cost for the camera network with various triggering thresholds τ thr . The plot shows the results of 1-h-long experiments performed 10 times independently. The cost is large for both low and high values of τ thr . For low values of τ thr , the cost is high due to the continuous reconfiguration of the network accumulating costs for both manager interventions and dropped frames.
Lower values of τ thr lead to frequent network reconfigurations by the network manager. Small disturbances in the camera scenes invoke manager interventions and lead to frame drops during network reconfigurations. Higher values of τ thr increase costs and variance. There are fewer network reconfigurations even during large disturbances in scenes captured by the cameras. This places more emphasis on the cameras to regulate their bandwidth usage, causing large number of frame drops. For τ thr ¼ ½0:3; 0:6�, the cost is lower compared to other values of τ thr . These values indicate a good trade-off between high costs due to frequent interventions and high costs due to dropped frames. Figure 9.: Total cost box plot for 10 1-h-long executions traces Figure 9 Total cost box plot for 10 1-hour long executions traces Figure 10 shows the trend of number of manager interventions for increasing values of τ thr . It shows a 5 point smoothed average of the number of manager interventions. The number of manager interventions reduces as τ thr increases as there are fewer network re-configurations and the manager is not invoked for small disturbances in the camera images. Higher values of τ thr lead to fewer manager interventions with no network reconfigurations even during large changes in camera scenes. Figure 11 shows a 5-point average of the number of dropped frames versus threshold τ thr . The number of dropped frames increases for higher values of τ thr due to lower number of manager interventions placing emphasis on quicker camera adaptations. These results show that the tuning of the cost function is non-trivial and can be varied by choosing the appropriate weights depending upon the behaviour of the camera network. Figure 10.: Manager Interventions Figure 11.: Dropped Frames

Related work
Video transmission using self-adaptive cameras have been investigated in scenarios where images are transmitted over the internet or local area networks with focus on image compression [22][23][24][25][26][27]. Research on video transmission has led to transmission protocols such as RTP, RTSP, SIP and improvements upon them which measure key network parameters, such as bandwidth usage, packet loss and round-trip delays. These help to cope with network load conditions, controlling the load submitted to the network [28] or using traffic prioritisation [29]. Research into image compression led to standards to reduce bandwidth utilisation like MJPEG, JPEG2000, MPEG-4, H.264, MPEG-H and H.265 that remove redundant information in sequence of frames. Some research domains impose limitations on the acceptable delays in the system. For example, augmented reality [30], industrial supervised multimedia control [24], multimedia embedded systems [31], automated inspection [32] and vehicle navigation [33]. Video surveillance is similar. Image compression is frequently preferred to video compression. This is due to lower latency incurred and low memory and computing requirements during image compression compared to video compression. The variability that occurs during compression complicates fitting the compressed image to the instantaneous network conditions. This has motivated substantial research into adaptive techniques [24,25,31]. These works focus mainly on the adaptation of streams to what the network provides. Not on the scheduling on the network. A way of achieving this network reservation is through the use of channels. This is addressed in [10] which addressed the problem using adaptive network channels using a global network manager that tracks camera bandwidth usage. Using control theory for quality adaptation used in the paper is similar to [25]. Our work adds to the camera adaptation by implementing a network bandwidth distribution strategy. Also explored in this paper is the use of classical and statistical model checking to verify desirable properties.
Although better performance can be obtained using domain knowledge to optimise bandwidth allocation [26], this paper assumes no such knowledge. Also investigated is the usage of cameras that transmit images using wireless networks [27] which highlights the need for adaptation. In this case it increases the amount of processing at the node. Compared to the work, this paper also provides formal guarantees on the system obtained via model checking.
Model checking has been applied to analyse complex system in recent times. [34,35] show the application of model checking to smart grids using different model checking tools. Model checking has also been used for finding errors in cloud applications [36].
This paper uses PRISM [9] for the camera network analysis. Using the support available for probabilistic models and statistical model checking, PRISM has been used for verification of a wide-variety of systems. For e.g. randomised distributed algorithms [37], software with probabilistic transitions [38], designs for applications using nanotechnology [39], communication protocols [40], selfadaptive software [41], security [42] and anonymous protocols [43]. PMC has been applied to verify properties of a video streaming system in [6]. In this work, high-fidelity simulations have been abstracted into probabilistic higher-level models. PMC has also been used in verification of safety and timeliness properties in air traffic control systems [7]. Contrary to all the mentioned papers, this paper uses PMC to verify a class of properties that is typically related with control-theoretical guarantees.

Conclusion
Model checking has shown great promise in verification of complex systems. Model checking is more exhaustive and robust verification approach compared to traditional methods such as software testing. The drawback of model checking is the state space explosion problem and translation of relevant properties of the system into formal language. The work in this paper addresses both of these concerns.
We applied model checking to a camera surveillance network with two independent strategies for bandwidth adaptation. We built two models of the adaptive cameras in the network, a linear model from [8] that did not consider disturbances during image encoding, and a second model that incorporated disturbances using probabilistic transitions in the model. Application of classical model checking techniques allowed for more informed choice of control parameters and triggering thresholds for the camera models, with and without disturbances. The camera model consisting of probabilistic disturbances led to state-space explosion due to memory issues. We showed that using SMC, the state-space explosion can be mitigated by performing property verification of complex models at the expense of relaxed bounds. Although the obtained bounds are not as robust as classical model checking, we obtained useful information on system performance and parameter selection. Finally, we evaluated the effect of different triggering thresholds on the number of manager interventions and dropped frames.