NBSIR 75-707

Tamper-Resistant Television

Surveillance System

Owen B. Laug & Kenneth W. Yee

Product Engineering Division

Institute for Applied Technology

National Bureau of Standards

Washington, D. C. 20234

May 1975

Final Report

Sponsored by:

U. S. Arms Control and Disarmament Agency

Washington, D. C. 20451

NBSIR 75-707

TAMPER-RESISTANT TELEVISION

SURVEILLANCE SYSTEM

Owen B. Laug & Kenneth W. Yee

Product Engineering Division

Institute for Applied Technology

National Bureau of Standards

Washington, D. C. 20234

May 1975

Final Report

Sponsored by: U. S. Arms Control and Disarmament Agency

Washington, D.C. 20451

U.S. DEPARTMENT OF COMMERCE, Rogers C.B. Morton. Secretary

NATIONAL BUREAU OF STANDARDS, Richard W. Roberts. Director

Table of Contents

Page

1. INTRODUCTION. 1

2. PRELIMINARY CONSIDERATIONS 2

3. DESIGN OBJECTIVES 3

k. SYSTEM DESCRIPTION 5

4.1 Encoder 9

4.2 Decoder 20

4.3 Paper Tape Reader 20

4.4 Motion Detector 22

5. FIELD TESTS 30

6. CONCLUSIONS 32

7. BIBLIOGRAPHY 34

i
List of Figures

Figure Title Page

1 Block diagram of tamper-resistant television

surveillance system, H

2 Block diagram of encoder. 8

3

'

^ Block diagram of permuter, 10

4 Block diagram showing pei*mutation scheme for

2 bit code. 12

5 Video encoder assembly. 15

6 Picture processed through the encoder-decoder

system. l6

7 Scrambled effect on the luminance of the picture

as a result of a mismatch of encoder-decoder

control codes. 17

8 Scrambled effect on the luminance of the picture

as a result of a mismatch of encoder-decoder

control codes. l8

9 Scrambled effect on the luminance of the picture

as a result of a mismatch of encoder-decoder

control codes. 19

10 Tape reader assembly. 21

11 Block diagram of motion detector 23

12 One motion detector assembly. 25

13 TV camera assembly in the NBS Reactor fuel

storage room. 28

1^ TV monitor assembly (above) and chassis for ten

motion detectors and video decoder. 29

ii
TAMPER-RESISTANT TELEVISION SUR^fEILLANCE SYSTEM

1. INTRODUCTION

The problem of the design of a tamper-reslstant/tamperIndlcating television surveillance system has been of concern to

the U.S. Arms Control and Disarmament Agency for a number of

years because of the role such a system might play in the process

of implementing and verifying certain international arms control

or safeguards agreements. The impetus to this cause is stated

in the preamble to -the Treaty on the Non-Proliferation of Nuclear

Weapons. It expresses on the part of the States concluding the

Treaty, "their support for research, development and other efforts

to further the application, within the framework of the International Atomic Energy Agency (IAEA) safeguards system, of the

principle of safeguarding effectively the flow of source and

special fissionable materials by use of instruments and other

techniques at certain strategic points."

In the summer of 1968 it became apparent to authorities

involved in safeguards in the United States of America and

Canada that a cooperative safeguards development program might

be of mutual benefit to the two governments and also support

the principles of the Non-Proliferation Treaty (NPT) and assist

the IAEA in carrying out its increased responsibilities under

the NPT. After several general discussions between officials

of both governments had confirmed a mutual interest, the two

parties agreed to Join in an effort to design, build, install,

and test on a CANDU-type power generating reactor, the prototype

of an unattended tamper-resistant/tamper-indicating safeguards

instrumentation system. The cooperating agencies in the two

Governments are the United States Atomic Energy Commission, (now

Energy Research and Development Agency) the United States Arms

Control and Disarmament Agency, Atomic Energy of Canada Limited,

and the Atomic Energy Control Board of Canada.

Since then, a joint US/Canadian Working Group composed of

members of the contributing agencies and contractors has developed

the overall features desired for the instrumentation system. The

program has two objectives:

1) To develop and evaluate prototype instrumentation

(unattended and secure) which may be applicable

to the safeguarding of nuclear material in reactors

and other nuclear facilities.

2) To test tamper-resistant/tamper-indicating techniques

and devices in the severe environment of an operating

power reactor.

This report describes a tamper-resistant television surveillance system designed to provide over long unattended

intervals high quality pictures which can be conveniently and

/
accurately interpreted by an inspector. It is intended to complement the safeguards instrumentation system presently under

test at the Nuclear Power Demonstration (NPD) reactor near

Rolphton, Ontario, Canada. This system is identified by the

acronym, TRUST, meaning, Tamper-Resistant Unattended Safeguards

Techniques. Such a system would complement the normal activity

of inspectors. Although the design considerations for this TV

system have been primarily determined by the surveillance requirements at NPD, it has the flexibility to be used in many

other surveillance applications where resistance to tampering

is required.

2. PRELIMINARY CONSIDERATIONS

Before dealing with the particular design aspects of the

TV surveillance system it is important to point out some of the

decisions and guidelines that have evolved from the Working Group,

It is these guidelines, some of which are political in nature,

that have influenced the particular design of this TV system.

One important guideline laid down by the Working Group is

that the system must be so designed that the integrity of the

safeguards data is maintained, although all design and operational details of the instruments are made available to the

reactor facility operator. The necessity for this arises from

two considerations. It is assumed that the design details of

all instrumentation would be revealed to all participating

governments and that the system must be acceptable to the

operator. The operator who is responsible for the safe and

economic operation of the station is in the best position to

determine whether a particular design involves no risk to the

station. Hence, design secrecy cannot be used as a technique

for maintaining measurement integrity.

It appears that no system is impenetrable. Given enough

time, money, and ingenuity, any system can be defeated. However, the major purpose can still be achieved if the system

is designed such that the cost and risk of fissionable materials

diversion greatly exceed the value of diversion and the

system indicates unequivocally that it has been tampered with.

Thus, the term tamper-resistant/tamper-indicating was adopted.

This does not necessarily simplify the design efforts of a

safeguards instrumentation system but provides a basis whereby

a crude figure of merit or cost effectiveness might be

established. For example this might be the cost of diversion

versus the cost of the safeguards system, or the cost of

diversion versus the value of a diversion. Care must be exercised in applying such a measure of effectiveness to only portions

of a system because of the interdependence of the subsystems.

In addition, economics in some instances may not be the primary

measurement of effectiveness.

2
Early In the program many designs of tamper-resistant sensors,

containers, and seals were evaluated. An outstanding problem was

maintaining security of the data link between the sensors and the

recording station. Time domain reflectometry techniques were

examined as a means of securing the data link but a number of

practical problems limited Its general application. The Working

Group reluctantly adopted the technique of encoding data as the

most practical means of securing data. Although this may seem

to violate the policy of not disclosing the system design, the

Important distinction Is that encoded data is used only for the

purpose of checking the integrity of data and not for the purpose

of withholding design or measurement information. In fact, many

portions of the system make available both clear data as well as

encoded data.

An additional problem which must be considered for any unattended system is that it is vulnerable to harassment by an

operator. He can damage the equipment "accidentally," cause

component failures which tend to discredit the system in the eyes

of the Inspector, or remove Installed safeguards equipment because

of an "operational emergency," Harassment of this nature is one

obvious unavoidable way to defeat an instrumentation system, A

good defense against subtle types of sabotaging is to employ the

simplest design possible with a high proven reliability. This

permits one to distinguish between true failures and harassment.

The Working Group concluded that harassment vras a manageable

problem as long as the inspection agency retained the capability

of replacing the unattended system with inspectors should it

become clear that the desired effectiveness and reliability were

not being achieved by this instrumentation.

3. DESIGN OBJECTIVES

Television was chosen Instead of direct film photography

because of its adaptability to a radiation environment. Long

term, low level radiation will not obscure the records nor will

a plausible accident wipe out all the data. In addition, TV

conforms to the generally adopted concept of remote sensing

devices reporting to one central recording station in a facility.

The following two principal design objectives for a TV

Surveillance system were established by the Working Group:

1. Unattended operation and data storage capacity

for a period up to 90 days.

2. Resistance to deception by video substitution on

the transmission line or direct scene substitution

In the TV camera field of view.

There are essentially two different approaches one can take

in the surveillance of an area. One approach is to record data

3

very frequently regardless of what is taking place in the area.

In the case of recording pictures the total number can easily overwhelm any reasonable storage capability and more important, can

make analysis difficult and costly. A bank camera uses this

approach by taking pictures continuously which are only analyzed

after the fact. Seldom do all the pictures have to be analyzed

since the time a robbery occurred is usually known. On the other

hand, if pictures are to be used to detect whether certain

unauthorized activity has occurred, a second approach is often

preferable. The technique is to selectively record pictures

of the scene when a "change occurs and limit the number when there

is no change. This can be accomplished by employing motion

detectors which monitor selected areas in the field of view

and record a picture if there is motion at any one of these

locations. This technique can also partially protect against

field-of-view substitution. Protection against tampering on

the video transmission line is provided by encoding the

luminance levels of the output video signal. It is these

two design features that have been the major area of development for this system. A qualitative description of the system

follows. Explicit operational details and schematics are not

included.

4. SYSTEM DESCRIPTION

Pig. 1 shows a block diagram of the tamper-resistant

television surveillance system. The system employs a commercial

525 line, high resolution, closed circuit TV system coupled

with a 16mm movie camera adapted for single frame use. Pictures

are photographed directly from the monitor with time indicated

on each frame by means of a digital clock located in the camera's

field of view. The video signal from the TV camera is encoded

for protection against substitution of false video information

on the transmission line to the recording station. Encoded video

signals are instantaneously decoded in the recording station so

that a continuous clear picture is present at all times on the

monitor. Coding security is insured by using matching sets of

random words stored on punched tape in the camera's secure container

and the secure recording station. Each word is used only once

for one recorded picture. After a picture is photographed the

tapes are advanced in synchronism to a new word which is used to

change the encoding pattern at the instant the next picture is

recorded.

Motion detectors, utilizing the video signal, monitor

selected spots in the TV camera field of view and command the

photographic camera to record a picture when there is motion

at any of these locations. The camera can also be commanded by

a random-interval timer.

A secure container houses the TV camera, encoder, and random

word tapes. The container is plastic, silvered on the inside for

security. A removable end cover is secured to the container by

5
a fiber optic seal [2,3] threaded through holes In the cover and

the container. The recording station stores all the data for the

entire safeguards system. This area consists of a small shielded

room secured by an RF intrusion monitor [^].

The reasons for choosing photographic means for recording

the pictures are the high quality, low cost, and high reliability

inherent with photographic techniques. Photography can be confidently employed in this location because it is well removed

from any possible source of radiation. Furthermore, photographic

film has the highest information packing density of any known

storage medium and pictures stored on film are convenient for

direct viewing or electronic analysis. Typically, a 100- foot

roll of 16 mm film can store about ^000 frames which can be

analyzed by use of a special projector. The projector can

operate at any desired frame rate without flicker and stop on

any frame indefinitely for detailed Inspection,

Magnetic tape recorders could also be employed for the

storage of pictures, especially for short unattended Intervals

and situations requiring immediate playback. Some surveillance

situations have been visualized where a resident Inspector may

want to review pictures of perhaps an overnight sequence. If

this technique were used to record single frames, provision

would have to be made to reliably operate the tape recorder in ' a start-stop mode.

The elements of the system which determine the quality of

pictures on film are the TV camera, encoder, decoder, monitor,

photographic camera, and film. The primary factors which affect

the overall quality of a picture are sharpness, resolution and

gray scale rendition. The appearance evaluation of a picture

image in terms of the edge characteristics of objects is called

sharpness. Sharpness and resolution are to some extent interrelated but do not always perfectly correlate. Resolution in

a television system is expressed in terms of the maximum number

of lines (black and white) which can be seen in a distance

across the face of the monitor tube equal to the raster height.

Vertical resolution in a well adjusted system roughly equals

the number of scanning lines. In practice, however, a standard

525 line system produces typical vertical resolution values of

about 450 lines because some of the lines are blanked for

frame synchronization purposes.

Resolution in photography is usually expressed as the

maximum number of lines (counting only black or white ones) per

millimeter which can be distinguished from one another. In order

to relate TV vertical resolution in terms of photographic

resolution the height of the frame and this factor of 2 must be

considered. The height of a I6 mm frame is about 8 mm. Thus,

a 450 TV line vertical resolution can be considered equivalent

to a photographic resolution of about 28 (l,e, 450/(2x8)) lines per

millimetre. However, to resolve the maximum TV vertical

6
resolution on film a photographic resolution (lens & film)

of greater than 28 lines per mm is required. This is because the

combination of both systems operating at the same limiting resolution produces a resultant resolution less than either. Considering

practical 16 mm film speeds and moderate lens qualities, measurements using standard high contrast photographic resolution charts

indicated that a resolving power of about 65 lines per millimetre

(center) and 50 lines per millimetre (edges) could be achieved.

Evaluation of TV resolution chart images on film obtained through

the entire system (i.e. TV camera, monitor photographic camera)

indicated that the above resolution is sufficient to resolve the

maximum vertical TV resolution. In fact, under these conditions

it is possible to distinguish the raster scanning lines in an

ordinary picture.

In order to obtain the full vertical resolution of a TV picture

on film the 2:1 interlace system must be used. Random interlace

will produce only about one half of the typical vertical

resolution of a 525 line system on film.

1

Horizontal resolution of a TV system is determined entirely

by the bandwith of the system. The TV camera chosen for this

application has a specified resolution of 900 lines (center) and

600 lines (edges) which somewhat exceeds the practical resolution

limits of the photographic portion of the system. Hence, vertical

resolution is TV-limited and horizontal resolution is photographically limited.

The gray scale rendition of the system is primarily limited

by the encoding system which quantizes the gray scales of the

output video signal. The gray scale of a properly exposed film

usually far exceeds the gray scale resolution of typical closed

circuit TV systems.

An important feature of a TV camera in most surveillance

systems is the ability to compensate for variations in scene

illumination. This helps to maintain a reasonably constant

exposure, but more important, provides a constant amplitude video

signal which limits the dynamic range of the encoder.

Listed below is a summary of pertinent performance specifications of the TV camera and monitor employed for this application.

There are two scanning systems commonly employed in closed circuit TV systems,

random interlace and 2:1 interlace. In the random interlace there are roughly

262 lines per field and the line frequency is not locked to the frame rate.

This produces a slight random movement of the lines for each field which the eye

integrates giving the appearance of more vertical resolution. In a 2:1 interlace the scanning of a frame is divided into two parts, each part being referred

to as a field. In the odd field lines are scanned in the order 1,3,5,7, etc.,

until half the lines have been scanned. Then scanning begins again at line 2 and proceeds in the order 2,4,6, etc., until the entire frame has been scanned.

The effect of such interleaving is to reduce the flicker to the point where It

is no longer perceptible to the eye.

7
o

«/>

u

T3Oocwo£

atbO

COoo

CQ

•H 8
TV Camera

1. Resolution-900 lines center, 600 lines in corners,

at 30 frames per second, 4:3 aspect ratio

2. Automatic Light Range 5000:1, video remains constant

to within 6 dB for a change in vidicon faceplate

illumination from 2.2 to 1080 lux (0.2 to 100 footcandles).

3. Gray-Scale Rendition - resolves all ten shades of

gray on EIA TV Resolution Charts.

TV Monitor

1. Video Response - 10 MHz

2. Resolution - 800 lines center, 600 lines in corners

3. Linearity, Horizontal and Vertical - 2.% of picture height

4.1 Encoder

Pig. 2 shows a simplified block diagram of the encoder

outlined in Pig. 1. The elements consist of a 4 bit analog

to digital converter, permuter, and line drivers. The video

output signal from the TV camera is quantized into l6 levels

coded in a 4 bit binary Gray code. Preliminary investigation

and a search of the literature has shown that video luminance

levels quantized with 4 bit resolution produce acceptable

pictures after decoding with some noticeable contouring. Contouring caused by too coarse quantization produces pictures

similar to those painted by the familiar "paint by numbers"

technique. The effect is more noticeable in some pictures

because the eye requires rather accurate values of luminance

in large regions of gradually changing gray scale such as a

close-up view of a person *s face where shadowing is important

to the overall composition. Pictures which contain many

small details are more tolerant of gray scale quantization,

A horizontal resolution of 900 TV lines requires a bandwidth of about 10 MHz. The analog to digital (a/d) converter

must be able to make conversions at this rate. A multithreshold 4 bit converter, by far the fastest and most straightforward of all a/d converters, was designed for this application.

It requires only 15 comparators, operates almost instantaneously, and is limited only by the delays of one comparator

and a few logic gates. Transient errors and circuits required

to suppress them are eliminated by converting to a Gray code

rather than the natural binary code. A Gray code converter

9

offers higher accuracy and higher speed because each code differs

from the adjacent numbers in only one bit position. Hence,

the transitional errors of the video signal are reduced to one

bit which results in minimal picture noise.

The contouring effect from the ^ bit quantization is

further reduced by a simple technique which tends to smooth out

intensity transitions to levels approaching 5 bit quantization.

This is done by not providing hysteresis in the comparators of

the a/d. This causes an individual comparator to oscillate

when the signals approach the threshold levels. For instance,

if the level of a video signal is at the threshold value of

comparator number 8 the comparator will oscillate, resulting

in encoded levels oscillating between values of 7 and 8. The

frequency is high enough to produce a fine grained intensity

structure which to the eye or film appears as the average

between the two levels. The result is a much more pleasing

picture than that produced by pure 4 bit quantization.

The permuter of Fig. 2 permutes and inverts some of the

bits before they are transmitted to the recording station via

the line drivers. The purpose of scrambling the digital

information is to make it difficult to decode the information

in a sufficiently short time to substitute a false video signal

with the correct coding on the line. The maximum number of

permutations for the 4 bits is 4 factorial. Thus, to effect

the 24 possible combinations, a minimum of 5 binary control bits

are required. Fig. 3 shows in block form the scheme used that

provides 19 out of the 24 possible permutations. Each box

represents a double-pole double-throw (dpdt) switch connected

as a reversing switch. When the control for a switch is in

state 0 the input-output data lines are uncrossed and when in

state 1 they are crossed. Each dpdt switch is implemented with

standard logic gates. The advantage of this configuration is that

the maximum difference in signal propagation delay between any line

is that of one dpdt switch which typically may be 10 nanoseconds.

This amount of delay is far less than one picture element of the

highest resolution picture being considered. Although this line

permuter does not quite provide the maximum number of permutations

it is simple; it also provides a random inversion of some bits

because each dpdt switch inverts the data. Bits which go through

an even number are not inverted, regardless of which state the

switches are in. For the 32 possible control codes there are

some repeat permutations but no code repeats because different

bits can be inverted for the same permutation. For example in

Fig. 3 assume the following states for each switch:

CI = 1, C2 = 0, C3 = 1, C4 = 0, C5 « 1, then:

input A is switched to line 4 and inverted

input B is switched to line 1 and not inverted

11
12
Input C is switched to line 2 and inverted

input D is switched to line 3 and not inverted.

The line drivers receive the permuted digital video signal

from the permuter and convert it to a differential output signal.

This signal drives a balanced twisted-pair transmission line

terminated at each extreme in the characteristic impedance. The

advantage is that the- data is not affected by common-mode signals

induced on the line thereby insuring error-free transmission and

recovery of data over long lines.

During the blanking intervals of the video signals, when the

synchronization pulses occur, the output of the drivers are

inhibited to prevent an evader from determining which bits are

inverted, because at that time the value of the video luminance

signal is zero. Inhibiting the drivers during this interval also

allows the use of one of the video data lines for transmission

of the synchronization signal. Thus the transmission line

between the camera and recording station consists of four video

data lines, one of which carries the synchronization pulse, and

a fifth line for the blanking signal.

The command to advance to a new stored random word in the

camera package must simultaneously accompany a 2 bit random code.

To avoid complication in the figure this is not shown in Pig. 1.

The purpose of the 2 bit random code is to prevent an evader from

falsely advancing the tape reader prior to a genuine command. If

this were not done it would allow an evader to extract and record

the entire supply of encoded video patterns which in turn could

be transmitted to the recording station in sequence with the actual

commands. Sending a 2 bit code only at the time of update forces

any evasion attempts to operate in real time. In practice the 2

bit random code is permuted with 2 bits from the paper tape reader

and put into a data latch before they are used as control bits for

the permuter. Pig. 4 shows the scheme used to permute the 2 bit

random code. Two dpdt switches similar to those used in the

permuter permute the 2 bit code with 2 bits from the tape reader.

An additional 2 bits from the tape reader control the state of

each switch. Thus, the 2 bit code becomes part of the control code

for the permuter but its identity is lost through this subpermutation

process. This leaves only a one in four chance of guessing what

the 2 bit code will be before it arrives, or a one chance in four

of guessing how it is permuted. Injecting a known 2 bit code only

helps if the bits from the tape reader happen to be the complement

of the known 2 bit code. The probability of multiple successful

guesses diminshes rapidly with these odds.

The entire control code for the permuter is held in a data

latch which temporarily stores the code which is used until an

update command is received. The update command permits a new

word from the tape reader permuted with a new 2 bit code to be

transferred through the latch to the permuter. Approximately

13
0.5 ys after the update command has been received, the control code

Is latched into storage and used to determine the coding pattern

for the frame being photographed and subsequent frames. While

the control word Is held In the latch the tape reader advances

to a new word so that It can be Instantly used at the next update

command. The Instantaneous change of the code at the encoder and

decoder occurs essentially simultaneously so that the position In

the picture where the code was changed Is Imperceptible. In

addition, the time of code change is unrelated to the sweep

frequency of the camera, hence, the starting position of a code

change in the picture is entirely random. The picture is photographed at the time the code is changed so that there exists

practically no time for an evader to break the code and re-insert

false video information. This is Important to the security of the

system because attempts to break the code require full bit-by-blt

storage of the picture and accurate recognition of the time of a

code change.

Early in the design phases of this system it was recognized

that permuting a natural binary or Gray code is not entirely

secure under dynamic conditions (i,e. a changing input signal

for the same encoding pattern). This is because the least

significant bit (LSB) is the busiest, l,e. it has the highest ' frequency content relative to the other digits. In the natural

binary code from numbers 0 to 15 the LSB makes 15 transitions

and the MSB makes only one. The Gray code has 8 transitions in

the LSB and one in the MSB. Thus, it is possible to identify

the significance of the bits from their relative frequencies by

observing a scanning line of a normal video signal. An attempt

was made to develop a code which roughly equalizes the number

of transitions made by the LSB and MSB, This, however, complicated

the design considerably and Introduced more noise in the system.

Although a type of Gray code with equalized number of transitions

could be developed it was decided that the degree of extra

security offered by choosing a special code did not warrant the

added complexity and degradation in performance. Furthermore,

Identification of the significance of the bits does not break

the code because the bits that are Inverted must also be

determined. This, coupled with the fact that the system runs

asynchronously (no clock), makes decoding difficult. To effect

an evasion by substituting false video information requires

rapid identification of the code pattern and reinsertion of

a properly encoded false signal all in an Interval which can

not be detected. The resources required to do this seem

formidable particularly in relation to the low cost and simplicity of the encoder/decoder system and more than likely

would force evasion attempts to other areas.

Pig. 5 is a photograph of the entire video encoder which

is constructed on a 14 x 25 cm printed circuit card. The card

contains the circuits for the 4 bit a/d converter, permuter,

2 bit code permuter, data latch, and line drivers.

14
15
16
4<

Doo

a;3 O

-PO +J •H C

CU

OO

+j q; -a «M O o o

0)o I C Sh 05 <D C 13 •H O E o

:3 c

XI o

-pc o O 4J

0)

p E o ra

0) -H

v. E

<D

O

tH

£1 -P 3 d O 0) CO J-1

•H

17
18
i

lit ^

CO

<u -do

CO

u

(U o

:3 4J c o o

•HO

a

0) 0) ^ Xl

4J

Oo ^ 0) O I <D U O <U c -a

Ct) o c o

•H

C § ^O

<D -p o

-p c ce o Ew

4J -H o Eo

•2 ^ B to

cd 0) ^^ Ph oW ct)

60 •H

19
4.2 Decoder

The decoder consists of line receivers, de-permuter. Gray to

binary code converter, and digital to analog converter. The line

receivers convert the balanced differential signal on the transmission line to normal logic levels. The encoded 4-bit video

signal passes through a de-permuter which is actually a second

permuter of identical design to the one illustrated in Pig, 3,

An identical set of words on punched tape plus the 2 bits for

the random code control the permuter the same way as in Fig, 4,

so that the video signal is restored to its originally generated

Gray code. The Gray code must be converted to a natural binary

code before conversion to an analog signal. This is simply done

by a series of logic gates. The digital to analog converter

produces an analog signal by summing weighted currents of each

binary digit. Synchronization and blanking signals are summed

at this point to provide a complete composite video signal

suitable for the monitor.

The results of this tortuous path taken by the video signal

are shown in Pig. 6 which is an encoded-decoded picture of a scene

in the laboratory. The picture was originally taken directly from

the monitor on a 35 mm transparency and reprocessed for reproduction,

hence, the quality obtained is not representative of that on the

16 mm film. Pig. 7 is a picture of the same scene showing the

effect of a permuted video luminance signal as a result of a

mismatch in the two sets of code words or the results of an unsuccessful tamper. Note that the outlines for large objects are

still clearly visible and only the identities of small objects have

become obscured. Pig, 8 & 9 show additional permutation patterns.

In some cases the picture appears as a partial negative with the

contouring effect of quantization greatly accentuated. Some

patterns do not produce a very noticeable distortion but in all

cases they can be recognized as an improperly encoded or decoded

picture,

4 , 3 Paper Tape Reader

Punched paper tape is used to store the code words which

control each permuter. Commercial units were not suitable for

this application because their size and shape factor generally

were not compatible with the space available in the secure TV

camera container. Many of the commercial units intended as

input mediums for digital computers have high speed requirements

which are by no means required in this application. The speed

requirements are based on the minimum interval between recorded pictures which is rarely less than a few seconds,

A special tape reader in the form of a cassette was designed

for this application. Pig, 10 is a photograph of the assembly

with the front cover removed to show the internal details. The

approximate dimensions of the cylinder are 21 cm in diameter and

10 cm in length. The unit employs one inch (2,54cra) standard

20
21
fanfold paper tape which eliminates the need for take up reels

and the associated mechanisms. A pair of rubber pinch rollers

driven by a small 1 rpm clock motor advance the tape from the

supply compartment to the spent compartment. As the tape is

pulled through the reading head station it unfolds one leaf at

a time and folds up in the lower compartment. The compartments

have a tape capacity for up to 13 000 8-bit words.

Sensing of the holes at the reading station is accomplished

by means of an array of nine phototransistors and nine light

emitting diodes as the sources (i.e. one set for each hole). A

sprocket hole, smaller in diameter than a data hole, exists for

each character. This serves as an indexing hole which is also

sensed by photoelectric means. The command to advance the tape

to the next character starts the clock motor which then stops

on the next sprocket hole.

The cassette can be removed from the system and new tapes

loaded in a convenient working area. The operation of the system

is not affected by removal of both tape readers since each

permuter interprets this as a code of all ones. An additional

benefit to the cassette approach is that the possibility of theft

or surreptitious copying of tapes can be eliminated by sealing new

tapes in each cassette. Thus, an inspector simply removes a

spent unit and replaces it with a new sealed unit. The spent

unit would be returned to some central depot for reloading.

Motion Detector

The motion detector was designed to provide for selectively

recording only the most meaningful pictures of an area under

surveillance in order to reduce the necessary film storage

capacity and the burden of analysis. The premise to this is that

activity, especially in preselected areas, may be of interest

and therefore should be recorded. The basic principle of motion

detection is sensing a rate of change in luminance. Objects

which move generally cause a change in the luminance of the area

to or from which they have moved. Of course this assumes that

the reflectance of a moving object differs measureably from the

background reflectance of the monitored area. The range of measurement must have practical bounds to reject rapid changes such as

those caused by modulation of the illumination source and very

slow changes which have no significance.

The motion detector designed for this system operates from

the analog video signal to the TV monitor. Preselected spots are

monitored in the TV camera field of view and the photographic

camera is commanded to record a picture when there is motion at

any one of these locations. Motion in these areas is detected

by sensing changes in the video luminance levels which exceed a

predetermined rate of change. The system is designed to provide

up to ten spots which can be employed in the following two ways:

22
23
1. A single spot can be positioned over a critical area

or object to be monitored without incurring alarms

from areas which are unimportant or subject to normal

activity. This application can be extended to numerous

spots which individually monitor many areas of interest

in the scene.

2. A series of spots may be located in a horizontal or

vertical line where the passage of an object across

the line is significant. For example this technique

may be applied to detect objects lifted by an overhead

crane. Proper spacing between spots in relation to

minimum dimensions of the object of Interest will allow

detection of those objects which cross the monitored line.

In both applications it is desirable to locate the spots

where normal activity does not occur. However, extraneous pictures may be unavoidable if spots are positioned

to monitor a location in the background which is below

he'ad height in the foreground where normal activity

occurs.

Pig. 11 shows a block diagram of the motion detector system

for one of ten detectors. The heart of the detector is a sample

and hold system in which a gated video luminance signal is compared

with a previously stored level over some time interval. If the

new value of the gated signal differs from the stored value by

a fixed threshold, an alarm is produced which commands the camera

to take a picture. The motion alarm output signals of all motion

detectors are connected together so that an alarm from any

one will command the camera.

The synchronization (sync) signal is taken directly from the

decoder before it is combined with the video luminance signal.

This obviates the need to separate it again from the composite

signal. The sync processing circuit does several things. First

the horizontal sync pulses are separated from the vertical sync

signal. The sampling rate (i.e. the rate at which a video sample

is taken) is generated by a circuit which locks on to either the

odd or even field and produces pulses which occur at the rate of

one per five or one per fifty odd or even fields. This results

in a sampling rate of 6 Hz and 0.6 Hz for a 30 frames per second

system. The purpose of having available two sampling rates will

be explained later. Second, the horizontal sync pulses of the

sampled field are counted in an 8 stage binary counter. The 8

bit binary number representing the scanning line number of one

field goes to the spot positioning circuit.

The spot positioning circuit selects the point on the raster,

vertical and horizontal, where a video sample is taken. The vertical

position is determined by the state of 8 switches arranged in a

binary sequence. When the state of the counter matches the line

number set by the switches, a pulse is formed. This pulse is

delayed by a variable delay circuit which determines the horizontal

24
25
position of the sample. The pulse, about l/50th the length of a

single scanning line, is gated at the sampling rate to produce the

sample command for the sample-and-hold circuit. In general the

smaller the sample the greater the sensitivity to motion. This

is because the sample represents an area which should be small in

relation to the area covered by a moving object to realize the

greatest change in illumination. A marker pulse identical to the

sample pulse is also produced and combined with the video signal

before it goes to the monitor. This produces an intensified area

on the monitor representing the size and location of the monitored

spot. By observing the monitor the position of the spot can be

set over the desired area. The pictures in Pig. 6, 7» 8, and 9

show eight spots. Two sets are located in the doorway and two

sets are located to the right of the door. In this arrangement

a picture would be recorded when someone walked through the

doorway or moved the trash container.

The sample and hold circuit is essentially an electronic switch

and storage capacitor. The sample command closes the switch and

the capacitor quickly attains the voltage value of the sampled video.

When the switch is open the capacitor retains this value over the

sampling interval. The output of the sample and hold circuit goes

to a differentiator which is composed of a single RC network. This

circuit responds only to a change in voltage at the sample time.

In other words if a change occurs between the time the last sample

was taken and a new sample, then the differentiator will respond

with an output. Conversely if there is no change in level from

sample to sample, then the output of the differentiator will remain

at zero. The output of the differentiator is followed by an amplifier to boost the derivative signal. The output of the amplifier

goes to a bipolar threshold detector which produces a motion alarm

signal if the peak voltage exceeds positive or negative threshold

levels. The purpose of bipolar threshold levels is for detection

of luminance changes in either direction (i.e. light to dark and

dark to light )

.

Pig. 12 is a photograph which shows a card containing the

components for one motion detector. The eight switches at the

edge are for positioning the spot vertically. The two upper switches

are for turning off the marker and the motion alarm signal. In

most cases it is desirable to leave the markers on to help identify

which spot triggered the camera. Turning off the motion alarm allows

a detector to be disabled without pulling out the card. The system

also permits any number of cards from 1 to 10 to be used.

The sensitivity is determined by the gain of the amplifier

following the sample and hold circuit and the threshold levels.

In this system the sensitivity is, to a large extent, limited by

the 4 bit resolution of the luminance signal. Increasing the motion

detector sensitivity much beyond this Just increases the false

alarm rate due to noise in the signal, A low-pass filter preceding

the sample-and-hold circuit filters out the high frequency components

of the signal not essential for detection of motion and reduces the

26
noise. In practice a one part in l6 change in illumination seems

to be quite adequate for motion detection.

Increasing the sampling interval enhances the sensitivity to

slowly moving objects such as large cranes which lift a load very

slowly. A faster sampling rate is more desirable for monitoring

the ordinary movements of people or faster moving machinery. One

sampling rate does not extend the sensitivity over the wide range

of possible rates of movement. For instance a detector using a

slow sampling rate would not necessarily detect a person walking

rapidly through the monitored area. For this reason two sampling

rates were made available so that a motion detector can be programmed for a fast (6 Hz) or a slow (0,6 Hz) sampling rate. If

an application requires detection of both slow and fast movements

in the same location, two motion detectors, one programmed for

slow and one for fast can be used as in Figure 6,

A second important function of the motion detectors is protection of the system against deception from insertion of false

scenes in the TV camera's field of view, movement of the camera

from its mounting, and substitution of video data on the transmission line. The detection of these possibilities manifests

itself in a recorded picture which shows evidence of tampering.'

Insertion of video signals from another source without the correct

code will produce scrambled gray levels which will be sensed by

the motion detectors causing a picture to be recorded. In the

case of attempted camera movement the result may be a recorded

picture that is mlsregistered in comparison to the other previous

frames. Experience has shown that very slight frame misalignment

of a single picture can be detected while playing back the film.

The speed of response of the motion detector is such that attempts

at scene substitution appear difficult. A sampling rate of 6 Hz

forces an evader to mechanically position a false scene and

associated optics in perfect registration in a period of less

than 167 milliseconds. In addition, the approximately correct

illumination must be provided. While such attempts are probably

difficult to implement an evader can take advantage of a lockout interval when no picture can be recorded. For practical

reasons some lock-out interval is required to limit the number

of frames when there is a great deal of motion.

The design provides for a lock-out period of approximately

2 minutes. This interval is generated by a separate clock which

provides a reset once every 2 minutes regardless of the state of

the motion detector output. In other words, the reset time is

not related to a motion alarm. Thus, after one alarm the motion

detector output might be enabled any time after that up to two

minutes. The uncertainty of the time when this reset may occur

coupled with the uncertainty of a command from the random interval

timer makes evasion attempts risky. Although there are ways of

determining the reset time, there are ways of increasing the

sophistication of the lock-out logic. For instance if there is

a simultaneous alarm from all the motion detectors this might

27
Pig. 13 TV camera assembly In the NBS Reactor fuel storage room,

28

override the lock-out because this is an unusual situation.

Randomizing the lock-out interval is another approach. None

of these techniques were implemented in this design mainly

because the purpose was to evaluate the effectiveness of the

motion detectors in a field environment.

5. FIELD TESTS

Before testing the system at the NPD reactor in Canada it

was installed in the NBS reactor fuel storage room. This area

provided an opportunity to make tests in an environment similar

to the NPD fuel storage room. Pig, 13 is a photograph in this

setting of the TV camera assembly which is mounted on a steel

pedestal. The silvered plastic cylinder houses the TV camera,

encoder, tape reader and power supplies. The cylinder (23 cm

diameter, 50 cm length) is supported in an aluminum cradle which

has an adjustable strut underneath to permit adjustments of the

viewing angle.

Pig, 14 is a photograph of the equipment that would be

located in the recording station. The monitor is shown with

a mirror removed to provide access to the screen and controls.

When the mirror is in place the image path from the screen to

the camera lens is folded to provide a compact arrangement.

The 16 mm camera and single frame advance mechanism are mounted

behind the mirror box. The bottom portion of the figure shows

the chassis and controls for ten motion detectors, video decoder,

tape reader, and power supplies.

During the week of June 11, 1972, the system was Installed

in the fuel storage room of the NPD reactor near Rolphton,

Ontario, Canada, The main area in the room consists of a deep

pool of water where all the spent fuel bundles are stored and

allowed to cool off. The basic purpose in applying surveillance

to this area is to ascertain that no unaccounted-for spent fuel

bundles or parts thereof are removed from the bay. The normal

removal method utilizes a large shielded cask which is lifted

by an overhead crane. There are, however, various other

unconventional means of removing fuel from the bay. The various

illicit means for removing fuel bundles from the bay have not

been clearly defined although it appears that bundles can be

lifted directly wl^hov't shielding.

All ten motion detectors were used for this test, A group

of spots were arranged in a line overhead to detect objects

lifted by the overhead crane. The remaining spots were positioned

in various areas where normal activity may occur for the purpose

of exercising the sys+-em. The random interval time and clock

time were obtained from the previously Installed TRUST instrumentation system. The random interval timer had a mean time of

20 minutes.

Operation over approximately a six month interval revealed

the following problems:

30
Operation over approximately a six month interval revealed

the following problems:

1. The tape readers tended to get out of synchronization,

causing scrambled pictures.

2. The video output from the TV camera occasionally dropped

out, requiring readjustment.

3. Several of the power supplies in the system failed.

The control circuitry for advancing the tape reader was redesigned

to make it less susceptible to interference and momentary power

outages. The difficulty with the TV camera has yet to be resolved.

It was discovered that the video often would not recover after

momentary power outages which occurred rather frequently. To

overcome the frequent power interruptions the system was put on

the TRUST instrumentation power supply system which consists of a

28 volt battery that is charge-maintained by the 120V, 60Hz power.

Since the TV system was designed for 120V, 60Hz, a 28 volt dc to

120 volt ac inverter had to be employed.

The failure of several power supplies was attributed to heat.

All power supplies in the system of the potted design eventually

failed. Apparently these commercial supplies cannot operate in

ambient temperatures of 45 to 50°C which is well within their

advertised specifications. Different power supplies of the

unpotted variety are being considered for replacements.

An additional problem which developed during the period

was noise on the video signal. It manifested itself in the form

of occasional white bars of about 1 ys in duration. When a noise

pulse occurred in the same location as a motion spot a false

alarm was produced. The noise did not appear to be of periodic

nature and the severity varied from time to time. Even though

the system was operated on the battery power supply the noise

persisted and was observable directly at the TV camera video

output. The source was attributed to two possibilities; the

camera itself, or a noisy machine in the facility.

The first roll of film was developed and analyzed on the

special stop-motion projector. The motion detectors performed

well by capturing a number of interesting sequences involving

unusual fuel handling operations. During periods of no activity

in the area the number of pictures recorded was essentially

limited by the random interval timer indicating that the false

alarm rate of the motion detectors was very low. One thing that

has become apparent from reviewing the pictures is that it is

desirable to shorten the motion lock-out period. Often there

are sequences where motion in an area triggered only one picture.

This is often insufficient information to determine the type of

activity taking place. Shortening the interval produces more

pictures but also consumes more frames. A more sophisticated

31
type of lock-out logic which provides for more pictures of a

sequence and economical use of frames could be designed.

Experience has also confirmed that the need for more than

ten spots is the exception rather than the rule. Situations

requiring more than 10 spots might occur when applications

require many spots to be used as containment perimeters around

certain objects.

6. CONCLUSIONS

A tamper-resistant television surveillance system has been

developed. The system utilizes commercial closed circuit TV

and photography coupled with a video encoding technique for

security, and motion detectors for selective recording of pictures. The incorporation of these additional features adds

little comparative complexity to ordinary closed circuit TV

while greatly increasing its effectiveness as a surveillance

tool for safeguards applications. Specific technical conclusions based on the work are listed below:

1, Video signals quantized in four bit Gray code and

decoded produce negligible distortion of pictures,

r 2, Permuting and inverting some of the bits of video

luminance signal before transmitting is an effective

technique of preventing substitution of false data.

3. A 2 bit code must be transmitted to the camera package

at the time of code update to maintain security.

^. The motion detectors enable a considerable saving of

recording capacity by selectively recording pictures

when motion occurs in preselected areas.

5. A slow and a fast sampling rate is required to

adequately detect the possible speeds of motion,

6. The motion detectors help to protect the system

against deception from insertion of false scenes

in the camera* s field of view.

7. Observing the film through a special stop-motion

projector appears to be a relatively fast and

accurate method of analyzing the data.

The problems revealed during the field tests do not appear

fundamental in nature and can be corrected by improved design.

The field test has made it clear that the motion lock out period

needs to be shortened and optimized for the application. A more

sophisticated lock-out logic which considers more factors in the

determination of the lock-out period could be designed. This

would tend to optimize the amount of useful information stored

for a given storage capacity.

32
One thing, which was not fully appreciated before, is now

apparent. The accumulation of field experience and information

regarding the effectiveness of the system will require a great

deal of time. Any system of this nature, although it may prevent

diversions, is potentially vulnerable to harassment. This point

was made more evident from some of the failures encountered,

particularly the synchronization problems with the tape readers

which can cause all the pictures to be scrambled. Although this

problem was corrected it still may be a weakness from the standpoint of harassment and therefore require a more thorough redesign. The reason for the guarded optimism is that still too

little is known of how this system might perform under a real

life situation. If the system can be made to fail without

indicating that it has been intentionally defeated then it will

be of little value. The many possible unthought-of diversions

and harassment techniques can only be uncovered by more tests

and experience especially by groups not involved in the original

design. Furthermore, because this system involves technology at

one point in the state of the art, future advancements in technology

may seriously endanger the effectiveness of the system. Hence,

the system must be continuously evaluated with respect to the

state of technology and the overall objective which is to provide

early detection of the diversion of nuclear material to other

than peaceful purposes.

33
7. BIBLIOGRPHY

[1] Pinal Report PT-45, Tamper Resistant Data Link, ACDA

June 1970

[2] Stiff, L. R., and Hogan, R. G., Corning Glass Works,

The Development of a Tamper Resistant Safing System

(Progress Report), July 1970

[3] Ulrich, R. R. Fiber Optic Seals: A Portable System

for Field Use in International Safeguards and Arms

Control Applications, Harry Diamond Laboratories

(HDL-TR-.I571) October 1971

[^] McManus, J, G, and Engle, A, V, Tamper Resistant

Unattended Safeguards Techniques. A Joint Canada/USA

Progress Report July 1970

34
NBS-n4A (REV. 7-73)

U.S. DEPT. OF COMM. BIBLIOGRAPHIC DATA

SHEET

1. PUBLICATION OR REPORT NO. MBSIR 7^-707

2. Gov't Accession

No.

3, Recipient's Accession No.

4. TITLE AND SUBTITLE

Tamper-Resist ant Television Surveillance System

5. Publication Date May 1975

6. Performing Organization Code

7. AUTHOR(S) Q„ej.^ La^g J. Kenneth W. Yee 8. Performing Organ. Report No.

9. PERFORMING ORGANIZATION NAME AND ADDRESS

NATIONAL BUREAU OF STANDARDS

UtrAKIMcNI Ur LUMMtKL.C WASHINGTON, D.C. 20234

10. Project/Task/Work Unit No.

11. Contract/Grant No. ACDA/WEC-FO/RA-126

12. Sponsoring Organization Name and Complete Address (Street, City, State, ZIP) U. S. Arms Control and Disarmament Agency

Washington, D. C. 20451

13. Type of Report & Period Covered Pinal

14. Sponsoring Agency Code

15. SUPPLEMENTARY NOTES

16. ABSTRACT (A 200-word or less factual suwn^ary ol most si^ilicant information. If document includes a significant bibliography or literature survey, mention it here.) This report describes a tamper- realstant television system. This system

will be part of a larger system used for verifying compliance with

certain international arms control or safeguard agreements. This work

is part of a joint U.S. -Canada safeguards research program to develop

and evaluate tamper-resistant, tamper-indicating techniques and instrumentation that might be applicable in safeguarding reactors or other

nuclear facilities. The principal design objectives are to provide a system capable of unattended operation, data storage capacity for a period up to 90 days, and resistance to deception by insertion of false

video Information on the transmission line or substitution of false scenes in the camera's field of view. These objectives are accomplished

by utilizing commercial high-resolution closed-circuit TV and photography

coupled with a video encoding technique v/hich permutes the luminance

signal in a different pattern for each recorded picture. Motion detectors, utilizing the video signal, provide the ability to selectively

record pictures when motion occurs in preselected areas, and protect the

system against Insertion of false scenes. The incorporation of these

additional features adds comparatively little complexity to ordinary

closed circuit TV while greatly Increasing its effectiveness as a surveillance tool for safeguards applications.

17. KEY WORDS (six to twelve entries: alphabetical order; capitalize only the first letter of the first key word unless a proper name: separated by semicolons

)

Safeguards; surveillance; tamper-resistant; television

18. AVAILABILITY {X2 Unlimited

I

' For Official Distribution. Do Not Release to NTIS

I I Order From Sup. of Doc, U.S. Government Printing Office Washington, D.C. 20402, SO Cat. No. C13 ^2 Order From National Technical Information Service (NTIS)

Springfield, Virginia 22151

19. SECURITY CLASS

(THIS REPORT)

UNCL ASSIFIED

20. SECURITY CLASS

(THIS PAGE)

UNCLASSIFIED

21. NO. OF PAGES

38

22. Price

$3.75

USCOMM.DC 29042-P74


/Si %