Lecture Notes in Computer Science 3472

18 Run-Time Verification 537
(propositions are represented by nodes), if the result is true then the BTT-FSM
stays in state s1 else is off is evaluated; if is off is false then the BTT-FSM
stays in state s1 else is closing is evaluated; if is closing is true then the output
is “formula violated” else the BTT-FSM moves to state s2. Whenaterminal
event is received due to termination of monitoring, if the BTT-FSM is in state
s1 then is flashing is evaluated; if is flashing is true then true is returned,
else is off is evaluated; if is off is true, false is returned, otherwise is true
is returned. Since only true/false messages are reported on terminal events, the
BTT-FSM that is executed when a terminal event is recognized is a Binary
Decision Diagram.
gate=open
light = off
open
gate=open off
light = off
gate=open closing gate=closing
light = off
light = off
s2 s2 s2 false
Fig. 18.5. Evaluation of the trace open, off, closing, flashing
In our example, at the initial state the gate is open and the light is off.
Figure 18.5 and 18.6 show the detailed evaluation progress for the traces:
• open, off, closing, flashing. (Formula violated)
• open, off, flashing, closing. (Formula verified)
gate = open open gate = open off
light = off light = off
s2 s2 s2
gate = open flashing gate = open closing
light = off
light = flashing
gate = closing
light = flashing
s1 true
Fig. 18.6. Evaluation of the trace open, off, flashing, closing
To simplify evaluation of the propositions in the BTT-FSM’s nodes, the value
assumed from the abstract state variables at each step is reported in the diagram.
The identifier of states traversed during the evaluation process and eventually
the verdict are shown below state variables. A transition from a state to the
following one is performed by evaluating an event of the execution trace. Events
that are successively evaluated are reported as labels of the edges. For example,
in the case of the sequence in Figure 18.5, the initial state of the BTT-FSM
is obtained by applying the initial state of the system to state s1. The light is
initially off, therefore the value of is flashing is false and the value of is off
is true; moreover, the gate is open, thus is closing is false, therefore the BTT-
FSM evolves to state s2. Then the event open is considered and the BTT-FSM
is evaluated again. Now, we are in state s2 and both is flashing and is closing
are false, hence we remain on state s2. The evaluation procedure continues in
this way until the event closing is reached. In this example, the BTT-FSM gets
the non-terminal event closing while it is in state s2, with the light set on off