1. Introduction
From micro and nanoscale cyber and physical/biological materials to selfdriving cars, smart factories and smart cities, cyberphysical systems (CPS) are reshaping the way in which we perceive and interact with our physical world, becoming ubiquitous in our society. CPS consist of collaborative, networked, spatially distributed, and tightly intertwined computational (logical) and physical components, each operating at different spatial and temporal scales. Therefore, the spatial and the temporal requirements are fundamentals for their safe and correct execution.
The openness of CPS with the possibility for new actors to join or to leave the system, the local interactions among the system components and the unknown environment in which they operate may cause undesired spatiotemporal emergent behaviours (i.e., congestion) often impossible to predict at the designtime. Indeed, their complexity restricts the exhaustive verification of their models runtime only to relatively small examples. Here, we pursue a complementary approach by introducing the SpatioTemporal Reach and Escape Logic (STREL), a novel formal specification language that enables to express in a concise way complex spatiotemporal requirements and to monitor them for the first time (to the best of our knowledge) over the execution of mobile and spatially distributed CPS.
The idea of the proposed framework stems from the attempt to generalise and to overcome some limitations of the SpatioSignal Temporal Logic (SSTL) previously introduced in (NenziBCLM15). SSTL extends the Signal Temporal Logic (MalerN13) with modalities (named somewhere and surround) to express also spatial properties and it is interpreted over a discrete model of the space, represented as a finite undirected graph. Each node represents a location in the space, characterised by a set of signals whose evolution can be observed in time, while each edge of the graph is labelled with a positive weight, that can be used to represent the distance between two nodes. This provides a metric structure to the space in terms of shortest path distances, enabling to monitor also spatial properties. However, since the topology of the graph in SSTL is assumed to be static, one main limitation is the impossibility to monitor nodes changing locations. Furthermore, monitoring of spatial properties is performed on each location by changing the graph so to consider only the locations that satisfy the distance constraint. This means that, the monitoring results of a location cannot be reused in the monitoring of its neighbours. In this work, we decide to completely reformulate the spatial modalities changing the perspective: instead of searching locations satisfying properties within a certain distance using the shortest path, the satisfaction of a location can be obtained by using monitored values obtained from the directly connected locations.
In particular, STREL generalizes SSTL by considering two new operators, named reach and escape. These new operators simplify the monitoring procedure that can be computed locally: the satisfaction of the property at each location depends only on the satisfaction of its neighbours^{†}^{†}We will see in Section 5 that this feature is very important to define distributed and online monitor algorithms.. Furthermore, while SSTL operates on spatiotemporal models that are static (the locations do not change their positions), STREL can handle also mobile/dynamic CPS. We also prove that, for a subclass of models, all the spatial properties expressed with reach and escape, using euclidean distance, satisfy all the transformed models through rotation, reflection and translation.
Another important feature of our logic considered in this paper is that, following an approach similar to the one considered in (LM05), we do not rely on a specific domain for interpreting logical properties. Indeed, STL/SSTL semantics can be either qualitative, ranging over boolean values, or quantitative, ranging over real values. In this paper, we propose both qualitative and quantitative semantics based on Constraint Semirings. These are algebraic structures that consist of a domain and two operations named choose and combine. Constraint semirings have been shown to be very flexible, expressive and convenient for a wide range of problems, in particular for optimization and solving problems with soft constraints and multiple criteria (BMR97). The use of semirings allows the definition of a single monitoring procedure that, being parametric with respect to the class of data collected from devices and values produced as results, can be used with different purposes. We then provide an offline monitoring algorithm for STREL, and, to illustrate the main features of the proposed formal framework, we show its application using the monitoring of a simulated Mobile Adhoc sensor NETwork (MANET) as our running example.
We want to stress that STREL is a flexible framework to formulate properties of CPS: the ability of freely mixing spatial and temporal operators to build complex queries, and to automatically construct monitoring algorithms, marks a neat difference from other related approaches, like the development of ad hoc solutions for specific properties.
The rest of this paper is organized as follows. Section 2 discusses the related work. Section 3 introduces the model we consider to represent the spatiotemporal signals, while section 4 provides the syntax and the semantics of STREL. An offline monitoring algorithm and its implementation is then discussed in section 5. In section 6, we show the logic at work on some examples, in particular we consider a MANET as case study. Section 7 draws our conclusions and discusses future works.
2. Related Work
Monitoring spatialtemporal properties over CPS executions was first proposed in (Talcott08) where the author has introduced the notion of spatialtemporal eventbased model for CPS. Events are triggered by the execution of actions, by the exchange of messages and by physical changes. Each generated event is labeled with time and space stamps and processed by a monitor. In (TVG09), this concept is further elaborated, developing a spatialtemporal eventbased model where the space is represented as a 2D Cartesian coordinate system with location points and location fields.
The approaches described in (Talcott08; TVG09) provide an algorithmic framework enabling a user to develop manually a monitor. However, they do not provide any spatiotemporal logic language enabling the specification and the automatic monitoring generation.
In the field of collective adaptive systems (CianciaLLM16), other mathematical structures, such as topological spaces, closure spaces, quasidiscrete closure spaces and finite graphs (NenziBCLM15), have been considered to reason about spatial relations, such as closeness and neighborhood. Despite these models are suitable for offline and centralised monitoring of modelbased simulations, they do not scale well for the runtime monitoring of spatially distributed CPS.
Several logicbased formalisms have been proposed to specify the behavior and the spatial structure of concurrent systems (CC04) and for reasoning about the topological (BC02) or directional (BS10) aspects of the interacting entities. In topological reasoning (BC02), the spatial objects are sets of points and the relation between them is preserved under translation, scaling and rotation. In directional reasoning, the relation between objects depends on their relative position. These logics are usually highly computationally complex (BS10) or even undecidable (MR99).
Monitoring spatialtemporal behaviors has started to receive more attention only recently with SpaTeL (bartocci2015) and SSTL (NenziBCLM15). The SpatialTemporal Logic (SpaTeL) (bartocci2015) is the unification of Signal Temporal Logic (MalerN13) (STL) and Tree Spatial Superposition Logic (TSSL) introduced in (bartocci2014; Bartocci2016)
to classify and detect spatial patterns. TSSL reasons over quad trees, spatial data structures that are constructed by recursively partitioning the space into uniform quadrants. The notion of superposition in TSSL provides a way to describe statistically the distribution of discrete states in a particular partition of the space and the spatial operators corresponding to
zooming in and out in a particular region of the space. By nesting these operators, it is possible to specify selfsimilar and fractallike structures (GrosuSCWEB09) that generally characterize the patterns emerging in nature. The procedure allows one to capture very complex spatial structures, but at the price of a complex formulation of spatial properties, which are in practice only learned from some template image.Another important work to mention is Voltron (MottolaMWG14), an opensource teamlevel programming system for drone’s collaborative sensing. Voltron provides special programming constructs to reason about time and space and allows users to express sophisticated collaborative tasks without exposing them to the complexity of concurrent programming, parallel execution, scaling, and failure recovery. The spatial constructs are limited to operate on a set of locations of a given geometry (that the user needs to specify). The system is suitable more for programming than for monitoring. For example, it does not allow to quantify how much the current CPS execution is close to violate a given requirement.
3. Spatial Models, Signals and Traces
In this section, we introduce the model of space we consider, and the type of signals that the logic specifies.
3.1. Constraint Semirings
An elegant and general way to represent the result of monitoring is based on constraint semiring. This is an algebraic structure that consists of a domain and two operations named choose and combine. Constraint semirings are subclass of semirings which have been shown to be very flexible, expressive and convenient for a wide range of problems, in particular for optimisation and solving problems with soft constraints and multiple criteria (BMR97), and in model checking (LM05).
Definition 3.1 (semiring).
A constraint semiring (just semiring in the following) is a tuple composed by a set , two operators , and two constants , such that:

is an associative, commutative, idempotent operator to “choose” among values^{†}^{†}We let to denote ., with ;

is an associative, commutative operator to “combine” values;

distributes over ;

, , , for all ;

, which is defined as iff , provides a complete lattice .
We say that a semiring is idempotent if and only if for any . Moreover, we say that a semiring is total when is a total order.
With an abuse of notation we sometimes refer to a semiring with the carrier and to its components by subscripting them with the carrier, i.e., , , and . For the sake of a lighter notation we drop the subscripts if clear from the context.
Example 3.2 ().
Typical examples of semirings that we will use in this paper are^{†}^{†}We use (resp. ) to denote (resp. ).:

the Boolean semiring ;

the tropical semiring ;

the max/min semiring: ;

the integer semiring: .
Boolean, max/min and integer semirings are idempotent while tropical semiring is not. All the above semirings are total.
One of the advantages of semirings is that these can be easily composed. For instance, if and are two semirings, one can consider the cartesian product where operations are applied elementwise.
3.2. Spatial model
Space is represented via a graph with edges having a weight from a given semiring.
Definition 3.3 ().
Let be a semiring, a spatial model is a pair where:

is a set of locations, also named space universe;

is a proximity function associating at most one label with each distinct pair .
We will use to denote the set of spatial models, while indicates the set of spatial models having as a set of locations. In the following, we will equivalently write as or , saying that is next to with weight .
A special class of spatial models are the ones based on Euclidean spaces.
Definition 3.4 (Euclidean spatial model).
Let be a set of locations, a (reflexive) relation and a function mapping each location to a point in , we let be the spatial model^{†}^{†} is the min/max semiring considered in Example 3.2. such that:
Note that we label edges with a 2dimensional vector
describing how to reach from , i.e., . This obviously allows us to compute the euclidean distance between and as , but, as we will see, allows us to compute the euclidean distance of any pair of locations connected by any path, not necessarily by a line in the plane.Example 3.5 (Mobile Ad hoc sensor NETwork).
A Mobile Adhoc sensor NETwork (MANET) is a sensor network that can consist of up ten thousands of mobile devices connected wirelessly. The devices are usually deployed to monitor environmental changes such as pollution, humidity, light and temperature. Each sensor node can be equipped with a sensing transducer, data processor, a radio transceiver and an embedded battery. It can move independently in any direction and change its links to other devices. Two nodes can communicate each other if their Euclidean distance is at most their communication range as depicted in Fig. 1 (right) . Moreover, the nodes can be of different type and their behaviour and communication can depend on their types.
2. Related Work
Monitoring spatialtemporal properties over CPS executions was first proposed in (Talcott08) where the author has introduced the notion of spatialtemporal eventbased model for CPS. Events are triggered by the execution of actions, by the exchange of messages and by physical changes. Each generated event is labeled with time and space stamps and processed by a monitor. In (TVG09), this concept is further elaborated, developing a spatialtemporal eventbased model where the space is represented as a 2D Cartesian coordinate system with location points and location fields.
The approaches described in (Talcott08; TVG09) provide an algorithmic framework enabling a user to develop manually a monitor. However, they do not provide any spatiotemporal logic language enabling the specification and the automatic monitoring generation.
In the field of collective adaptive systems (CianciaLLM16), other mathematical structures, such as topological spaces, closure spaces, quasidiscrete closure spaces and finite graphs (NenziBCLM15), have been considered to reason about spatial relations, such as closeness and neighborhood. Despite these models are suitable for offline and centralised monitoring of modelbased simulations, they do not scale well for the runtime monitoring of spatially distributed CPS.
Several logicbased formalisms have been proposed to specify the behavior and the spatial structure of concurrent systems (CC04) and for reasoning about the topological (BC02) or directional (BS10) aspects of the interacting entities. In topological reasoning (BC02), the spatial objects are sets of points and the relation between them is preserved under translation, scaling and rotation. In directional reasoning, the relation between objects depends on their relative position. These logics are usually highly computationally complex (BS10) or even undecidable (MR99).
Monitoring spatialtemporal behaviors has started to receive more attention only recently with SpaTeL (bartocci2015) and SSTL (NenziBCLM15). The SpatialTemporal Logic (SpaTeL) (bartocci2015) is the unification of Signal Temporal Logic (MalerN13) (STL) and Tree Spatial Superposition Logic (TSSL) introduced in (bartocci2014; Bartocci2016)
to classify and detect spatial patterns. TSSL reasons over quad trees, spatial data structures that are constructed by recursively partitioning the space into uniform quadrants. The notion of superposition in TSSL provides a way to describe statistically the distribution of discrete states in a particular partition of the space and the spatial operators corresponding to
zooming in and out in a particular region of the space. By nesting these operators, it is possible to specify selfsimilar and fractallike structures (GrosuSCWEB09) that generally characterize the patterns emerging in nature. The procedure allows one to capture very complex spatial structures, but at the price of a complex formulation of spatial properties, which are in practice only learned from some template image.Another important work to mention is Voltron (MottolaMWG14), an opensource teamlevel programming system for drone’s collaborative sensing. Voltron provides special programming constructs to reason about time and space and allows users to express sophisticated collaborative tasks without exposing them to the complexity of concurrent programming, parallel execution, scaling, and failure recovery. The spatial constructs are limited to operate on a set of locations of a given geometry (that the user needs to specify). The system is suitable more for programming than for monitoring. For example, it does not allow to quantify how much the current CPS execution is close to violate a given requirement.
3. Spatial Models, Signals and Traces
In this section, we introduce the model of space we consider, and the type of signals that the logic specifies.
3.1. Constraint Semirings
An elegant and general way to represent the result of monitoring is based on constraint semiring. This is an algebraic structure that consists of a domain and two operations named choose and combine. Constraint semirings are subclass of semirings which have been shown to be very flexible, expressive and convenient for a wide range of problems, in particular for optimisation and solving problems with soft constraints and multiple criteria (BMR97), and in model checking (LM05).
Definition 3.1 (semiring).
A constraint semiring (just semiring in the following) is a tuple composed by a set , two operators , and two constants , such that:

is an associative, commutative, idempotent operator to “choose” among values^{†}^{†}We let to denote ., with ;

is an associative, commutative operator to “combine” values;

distributes over ;

, , , for all ;

, which is defined as iff , provides a complete lattice .
We say that a semiring is idempotent if and only if for any . Moreover, we say that a semiring is total when is a total order.
With an abuse of notation we sometimes refer to a semiring with the carrier and to its components by subscripting them with the carrier, i.e., , , and . For the sake of a lighter notation we drop the subscripts if clear from the context.
Example 3.2 ().
Typical examples of semirings that we will use in this paper are^{†}^{†}We use (resp. ) to denote (resp. ).:

the Boolean semiring ;

the tropical semiring ;

the max/min semiring: ;

the integer semiring: .
Boolean, max/min and integer semirings are idempotent while tropical semiring is not. All the above semirings are total.
One of the advantages of semirings is that these can be easily composed. For instance, if and are two semirings, one can consider the cartesian product where operations are applied elementwise.
3.2. Spatial model
Space is represented via a graph with edges having a weight from a given semiring.
Definition 3.3 ().
Let be a semiring, a spatial model is a pair where:

is a set of locations, also named space universe;

is a proximity function associating at most one label with each distinct pair .
We will use to denote the set of spatial models, while indicates the set of spatial models having as a set of locations. In the following, we will equivalently write as or , saying that is next to with weight .
A special class of spatial models are the ones based on Euclidean spaces.
Definition 3.4 (Euclidean spatial model).
Let be a set of locations, a (reflexive) relation and a function mapping each location to a point in , we let be the spatial model^{†}^{†} is the min/max semiring considered in Example 3.2. such that:
Note that we label edges with a 2dimensional vector
describing how to reach from , i.e., . This obviously allows us to compute the euclidean distance between and as , but, as we will see, allows us to compute the euclidean distance of any pair of locations connected by any path, not necessarily by a line in the plane.Example 3.5 (Mobile Ad hoc sensor NETwork).
A Mobile Adhoc sensor NETwork (MANET) is a sensor network that can consist of up ten thousands of mobile devices connected wirelessly. The devices are usually deployed to monitor environmental changes such as pollution, humidity, light and temperature. Each sensor node can be equipped with a sensing transducer, data processor, a radio transceiver and an embedded battery. It can move independently in any direction and change its links to other devices. Two nodes can communicate each other if their Euclidean distance is at most their communication range as depicted in Fig. 1 (right) . Moreover, the nodes can be of different type and their behaviour and communication can depend on their types.
3. Spatial Models, Signals and Traces
In this section, we introduce the model of space we consider, and the type of signals that the logic specifies.
3.1. Constraint Semirings
An elegant and general way to represent the result of monitoring is based on constraint semiring. This is an algebraic structure that consists of a domain and two operations named choose and combine. Constraint semirings are subclass of semirings which have been shown to be very flexible, expressive and convenient for a wide range of problems, in particular for optimisation and solving problems with soft constraints and multiple criteria (BMR97), and in model checking (LM05).
Definition 3.1 (semiring).
A constraint semiring (just semiring in the following) is a tuple composed by a set , two operators , and two constants , such that:

is an associative, commutative, idempotent operator to “choose” among values^{†}^{†}We let to denote ., with ;

is an associative, commutative operator to “combine” values;

distributes over ;

, , , for all ;

, which is defined as iff , provides a complete lattice .
We say that a semiring is idempotent if and only if for any . Moreover, we say that a semiring is total when is a total order.
With an abuse of notation we sometimes refer to a semiring with the carrier and to its components by subscripting them with the carrier, i.e., , , and . For the sake of a lighter notation we drop the subscripts if clear from the context.
Example 3.2 ().
Typical examples of semirings that we will use in this paper are^{†}^{†}We use (resp. ) to denote (resp. ).:

the Boolean semiring ;

the tropical semiring ;

the max/min semiring: ;

the integer semiring: .
Boolean, max/min and integer semirings are idempotent while tropical semiring is not. All the above semirings are total.
One of the advantages of semirings is that these can be easily composed. For instance, if and are two semirings, one can consider the cartesian product where operations are applied elementwise.
3.2. Spatial model
Space is represented via a graph with edges having a weight from a given semiring.
Definition 3.3 ().
Let be a semiring, a spatial model is a pair where:

is a set of locations, also named space universe;

is a proximity function associating at most one label with each distinct pair .
We will use to denote the set of spatial models, while indicates the set of spatial models having as a set of locations. In the following, we will equivalently write as or , saying that is next to with weight .
A special class of spatial models are the ones based on Euclidean spaces.
Definition 3.4 (Euclidean spatial model).
Let be a set of locations, a (reflexive) relation and a function mapping each location to a point in , we let be the spatial model^{†}^{†} is the min/max semiring considered in Example 3.2. such that:
Note that we label edges with a 2dimensional vector
describing how to reach from , i.e., . This obviously allows us to compute the euclidean distance between and as , but, as we will see, allows us to compute the euclidean distance of any pair of locations connected by any path, not necessarily by a line in the plane.Example 3.5 (Mobile Ad hoc sensor NETwork).
A Mobile Adhoc sensor NETwork (MANET) is a sensor network that can consist of up ten thousands of mobile devices connected wirelessly. The devices are usually deployed to monitor environmental changes such as pollution, humidity, light and temperature. Each sensor node can be equipped with a sensing transducer, data processor, a radio transceiver and an embedded battery. It can move independently in any direction and change its links to other devices. Two nodes can communicate each other if their Euclidean distance is at most their communication range as depicted in Fig. 1 (right) . Moreover, the nodes can be of different type and their behaviour and communication can depend on their types.
4. Spatiotemporal Reach and Escape Logic
In this section, we present the SpatioTemporal Reach and Escape Logic (STREL), an extension of the Signal Temporal Logic. We define the syntax and the semantics of STREL, describing in detail the spatial operators and their expressiveness.
4.1. Syntax
The syntax of STREL is given by
where is an atomic predicate (), negation and conjunction are the standard Boolean connectives, and are the Until and the Since temporal modalities, with a real positive closed interval. These are the standard temporal operators of STL, and we refer the reader to (MalerN13; Donze2013) for more details. The spatial modalities are the reachability and the escape operators, with a Distance Function, (we call their collection), described in the previous section, and a Distance Predicate (from a set of predicates), e.g., inequalities^{†}^{†}With an abuse of notation, we will denote by the predicate that complements .. The exact meaning of and depends on specific interpretation functions. This because, the monitored value associated with a formula depends on the considered domain. We impose that any occurring in a operator is , i.e., if satisfies and then satisfies . This because predicate represents an upper bound on a distance.
The reachability operator describes the behavior of reaching a location satisfying property passing only through locations that satisfy , through nodes whose distance from the initial location satisfy the predicate . The escape operator , instead, describes the possibility of escaping from a certain region passing only through locations that satisfy , via a route with distance satisfying the predicate . Differently from , in the predicate represents a lower bound. For this reason we assume that any interpretation of is , i.e., if satisfies and then satisfies ^{†}^{†} is if and only if is ..
As customary, we can derive the disjunction operator and the future eventually and always operators from the until temporal modality, and the corresponding past variants from the since temporal modality, see (MalerN13) for details. We can define also other three derived spatial operators: the somewhere and the everywhere that describe behaviors of some or of all locations at a certain distance from a specific point, and the surround that expresses the topological notion of being surrounded by a region, while being in a region, with additional metric constraints. A more thorough discussion of the spatial operators will be given after introducing the semantics.
4.2. Semantics
The semantics of STREL is evaluated pointwise at each time and each location. We stress that each STREL formula abstracts from the specific domain used to express the satisfaction value of as well as there is not explicit reference to the semiring used in the spatial model to express weights associated with edges. These, of course, are needed to define the semantics. In the following, we assume that is the domain of the spatiotemporal traces, while is the semiring where the logic is evaluated. Furthermore, is the semiring of weights, and is the semiring in which distance functions take values. To define the semantics, we also need three auxiliary functions. The signal interpretation function permits to translate the input trace in a different spatio temporal signal, for each atomic proposition in , which will be the input of the monitoring procedure. The function is used to interpret function symbols as proper distance functions, while maps distance predicate symbols into proper predicates.
Definition 4.1 (Semantics).
Let and B be two semirings, and and two signal domains. Let be a space universe, be a spatiotemporal trace for and the location service associating an Aspatial model at each time in Let , , and be the functions introduced above. The monitoring function of is recursively defined in Table 1.











Given a formula , the function corresponds to the evaluation of the formula at time in the location . The choice of and produces different types of semantics. As described in Section 3, we consider two signal domains: and , giving rise to qualitative and quantitative monitoring, correspond respectively to a Boolean answer value and real satisfaction value. We describe the semantics for the Boolean signal domain ( ). We say that satisfies a formula if . The procedure will be exactly the same for different choices of the formula evaluation domain, just operators have to be interpreted according to the chosen semirings and signal domains. We use the following example as the system on which we specify our properties, in particular we will use the graph in Figure 3 to describe the spatial operators.
Example 4.2 (ZigBee protocol).
In Fig. 3, the graph represents a MANET. In particular, we consider the nodes with three different roles such as the ones implemented in the ZigBee protocol: coordinator, router and EndDevice. The Coordinator node , represented in green color in the graph, is unique in each network and is responsible to initialize the network. After the initialisation, the coordinator behaves as a router. The Router node , represented in red color in the graph, acts as a intermediate router, passing on data from other devices. The EndDevice node , represented in blue, can communicate only with a parent node (either the Coordinator or a Router) and it is unable to relay data from other devices. Nodes move in space and the figure corresponds to the spatial configuration at a fixed time . As trace and location service, let us consider a spatial model as the proximity graph presented in Example 3.5 and a trace over this graph denoting the kind of node, i.e. if is a coordinator, if is a router, and if is an end node.
Atomic Proposition. Different types of atomic propositions and signal interpretations are admissible. We can simply consider a finite set and an interpretation function iff . E.g., in Fig. 3, we can consider atomic propositions describing the type of node, i.e., the boolean propositions are true if the node is of the corresponding type. In case of real valued signals and of a quantitative interpretation of the logic ( being in this case the real valued max/min semiring), we can consider inequalities for some real function and define .
Negation.
Conjunction.
Until. . As customary, satisfies
5. Monitoring STREL
In this section, we present a monitoring algorithm that can be used to check if a given signal satisfies or not a STREL property. The proposed algorithm follows an offline approach. Indeed, it takes as input the complete spatiotemporal signal together with the property we want to monitor. At the end of this section, we will also briefly discuss a possible alternative approach that can lead to a distributed and online monitoring procedure. In this case, the spatiotemporal signal is not known at the beginning, it is discovered while data are collected from the system during its execution.
5.1. Offline monitor
Offline monitoring is performed via the function that takes as inputs a location service , a trace and a formula and returns the piecewise constant spatiotemporal signal representing the monitoring of . The function also relies on parametrised with respect to functions , and , used to interpret symbols in formulas, and operators , and of signal domain, used to represent satisfaction values.
The function is defined by induction on the syntax of the formula^{†}^{†}This definition is straightforward and, for the sake of readability, we only report it in Appendix, available in the extend version of this article at https://github.com/Quanticol/strel. The spatiotemporal signal resulting from the monitoring of atomic proposition is just obtained by applying function to the trace . The spatiotemporal signals associated with and are obtained by applying operators and to the signals resulting from the monitoring of and from the monitoring of and .
Monitoring of temporal properties, namely and , can be done by using the same approach used in (Donze2013) and (MalerN13). However, while their monitoring relies on classical boolean and arithmetic operators, here the procedure is parametrised with respect to operators and of the considered semiring.
To monitor first the signals and resulting from the monitoring of and are computed. After that, the final result is computed by aggregating the spatial signals and at each time with function , defined in Algoritm 1. This function also takes as parameters the spatial model at time (obtained from the location service), the function used to compute the distances over paths, and the predicate describing the reachability bound. In function , the data structure is iteratively computed. This data structure associates each location with a set of triples . Intuitively, is in after iterations if and only if: can reach with at most steps with a distance at least ( satisfying ) and a monitored value . At the beginning is initialised to . Moreover, at each iteration, the values in are updated by considering the elements in , for any next to . The loop continues until a fix point is reached. Note that, termination of the algorithm is guaranteed by the fact that is an idempotent semiring and from the fact that, for any , if and then . The result spatial signal associates each location with the value .
Monitoring algorithm for is reported in Algorithm 2, where function is defined. Given a space model at time , a distance function , a distance predicate and a spatial signal, it computes the spatial signal representing the monitoring value of at time . Function iteratively computes the data structure obtained by that associates each location with a set of triples of the form representing the fact that can escape in with a distance and a total value . At each iteration, these values are updated by considering the values in the neighbours in each location. Similarly to function , this computation continues until a fixpoint is reached. After that, the monitored value associated with each location is computed as .
Remark. The offline monitoring iteratively computes the monitor value at a location by considering the values of monitoring in the previous iteration. This approach easily enables the definition of a parallel monitoring algorithm. Indeed, both the functions defined in Algorithm 1 and Algorithm 2 can be parallel executed for each location. The different monitoring instances must communicate to exchange the values computed at iteration . Another possible improvement of this algorithm is based on an online computation of the monitoring. Following an approach similar to the one considered in (DDGJJS15), each location can identify its monitoring value by using only partial informations. Early termination of the monitor procedure is then possible when the satisfaction or violation of a property is found.
6. Examples
In this section we present some example of the expressibility and potentiality of STREL.
6.1. ZigBee protocol monitoring
Given a MANET with a ZigBee protocol (Example 4.2), we consider as spatial models both its proximity and connectivity graphs, computed with respect to the Cartesian coordinates. The Nodes have three kinds of roles: coordinator, router and EndDevice, as described in Example 4.2. Moreover, each device is also equipped with a sensor to monitor its battery level (), the humidity () and the pollution () in its position. The semiring is the union between the max/min semiring (for the proximity graph) and the integer semiring (for the connectivity graph). We will use also two types of distances: and the distances described in Example 3.9. As in the Example 4.2, atomic propositions describe the type of nodes. We also consider inequalities on the values that are read from sensors, plus special propositions which encode the address of a specific location, i.e. they are true only in the location .
In the following, we describe several properties of these ZigBee MANET networks that are easily captured by STREL logic, to exemplify its expressive power.
A class of properties naturally encoded in STREL related to the connectivity of the network. First, we can be interested to know if a node is properly connected, meaning that it can reach the coordinator through a path of routers:
(1) 
The meaning of this property is that an end node reaches in a step a node which is a router and that is connected to the coordinator via a path of routers.
We may also want to know if there is a path to the router which is reliable in terms of battery levels, for instance such that all routers have a battery level above 30%:
(2) 
Comments
There are no comments yet.