5/12/98

Real-time Systems GroupUniversity of Pennsylvania

Example: Railroad Crossing• There are 3 processes: a train, a controller and a gate• Safety property

– When a train is in the crossing, a gate should be down

Satisfy the safety property

Violate the safety property

5/12/98

Real-time Systems GroupUniversity of Pennsylvania

Monitoring Script for Railroad CrossingMonScr RailRoadCrossing export event startIC, endIC, startGD, endGD;

MonVarDcl : float RRC.train_x; int RRC.train_length; int RRC.cross_x; int RRC.cross_length;

MonMethodDcl: Gate.gd(); Gate.gu();

CondDef: Cond IC = RRC.train_x + RRC.train_length > RRC.cross_x && RRC.train_x <= RRC.cross_x + RRC.cross_length;

EventDef: Event startIC = start(IC); Event endIC = end(IC); Event startGD = end_m(Gate.gd()); Event endGD = start_m(Gate.gu());End

ReqSpec RailRoadCrossing import event startIC, endIC, startGD, endGD;

CondDef:Cond IC = [startIC, endIC];Cond GD = [startGD, endGD];

SafePropDef:

SafeProp safeRRC = IC -> GD;

End

LegendGreen : program variables and methodsBlue : eventOrange : conditionRed : property

5/12/98

Real-time Systems GroupUniversity of Pennsylvania

Destination Host

Demo Scenario

Source HostRRC

RRC

Source Host

5/12/98

Real-time Systems GroupUniversity of Pennsylvania

Desti-nation Host

Source Host RRC

RRC(instrum-ented)

ProxyRRCRRC

(instrum-ented)

MonitoringScript

Demo Scenario

Host2Host1Event

Recognizer Checker

Proxy MonitoringScript

RRC.xRRC.cross...

startICstartGD

SafetyViolationDetection

5/12/98

Real-time Systems GroupUniversity of Pennsylvania

Desti-nation Host

Source Host RRC

RRC(instrum-ented)

ProxyRRCRRC

(instrum-ented)

MonitoringScript

Demo Slide

Host2Host1Event

Recognizer CheckerRRC.xRRC.cross...

startICstartGD

SafetyViolationDetection