1. Real-time Systems Group University of Pennsylvania 5/12/98 Example: Railroad Crossing There are 3 processes: a train, a controller and a gate Safety property –When a train is in the crossing, a gate should be down Satisfy the safety property Violate the safety property

2. Real-time Systems Group University of Pennsylvania 5/12/98 Monitoring Script for Railroad Crossing MonScr RailRoadCrossing export event startIC, endIC, startGD, endGD; MonVarDcl : float RRC.train_x; int RRC.train_length; int RRC.cross_x; int RRC.cross_length; MonMethodDcl: Gate.gd(); Gate.gu(); CondDef: Cond IC = RRC.train_x + RRC.train_length > RRC.cross_x && RRC.train_x <= RRC.cross_x + RRC.cross_length; EventDef: Event startIC = start(IC); Event endIC = end(IC); Event startGD = end_m(Gate.gd()); Event endGD = start_m(Gate.gu()); End ReqSpec RailRoadCrossing import event startIC, endIC, startGD, endGD; CondDef: Cond IC = [startIC, endIC]; Cond GD = [startGD, endGD]; SafePropDef: SafeProp safeRRC = IC -> GD; End Legend Green : program variables and methods Blue : event Orange : condition Red : property

3. Real-time Systems Group University of Pennsylvania 5/12/98 Destination Host Demo Scenario Source Host RRC Source Host

4. Real-time Systems Group University of Pennsylvania 5/12/98 Desti- nation Host Source Host RRC (instrum- ented) Proxy RRC (instrum- ented) Monitoring Script Demo Scenario Host2 Host1 Event Recognizer Checker Proxy Monitoring Script RRC.x RRC.cross... startIC startGD Safety Violation Detection

5. Real-time Systems Group University of Pennsylvania 5/12/98 Desti- nation Host Source Host RRC (instrum- ented) Proxy RRC (instrum- ented) Monitoring Script Demo Slide Host2 Host1 Event Recognizer Checker RRC.x RRC.cross... startIC startGD Safety Violation Detection