Monitoring Mobile and Spatially Distributed Cyber-Physical Systems

04/15/2019 ∙ by Ezio Bartocci, et al. ∙ 0

Cyber-Physical Systems (CPS) consist of collaborative, networked and tightly intertwined computational (logical) and physical components, each operating at different spatial and temporal scales. Hence, the spatial and temporal requirements play an essential role for their correct and safe execution. Furthermore, the local interactions among the system components result in global spatio-temporal emergent behaviors often impossible to predict at the design time. In this work, we pursue a complementary approach by introducing STREL a novel spatio-temporal logic that enables the specification of spatio-temporal requirements and their monitoring over the execution of mobile and spatially distributed CPS. Our logic extends the Signal Temporal Logic with two novel spatial operators reach and escape from which is possible to derive other spatial modalities such as everywhere, somewhere and surround. These operators enable a monitoring procedure where the satisfaction of the property at each location depends only on the satisfaction of its neighbours, opening the way to future distributed online monitoring algorithms. We propose both a qualitative and quantitative semantics based on constraint semirings, an algebraic structure suitable for constraint satisfaction and optimisation. We prove that, for a subclass of models, all the spatial properties expressed with reach and escape, using euclidean distance, satisfy all the model transformations using rotation, reflection and translation. Finally, we provide an offline monitoring algorithm for STREL and, to demonstrate the feasibility of our approach, we show its application using the monitoring of a simulated mobile ad-hoc sensor network as running example.

READ FULL TEXT VIEW PDF
POST COMMENT

Comments

There are no comments yet.

Authors

page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1. Introduction

From micro- and nano-scale cyber and physical/biological materials to self-driving cars, smart factories and smart cities, cyber-physical systems (CPS) are reshaping the way in which we perceive and interact with our physical world, becoming ubiquitous in our society. CPS consist of collaborative, networked, spatially distributed, and tightly intertwined computational (logical) and physical components, each operating at different spatial and temporal scales. Therefore, the spatial and the temporal requirements are fundamentals for their safe and correct execution.

The openness of CPS with the possibility for new actors to join or to leave the system, the local interactions among the system components and the unknown environment in which they operate may cause undesired spatio-temporal emergent behaviours (i.e., congestion) often impossible to predict at the design-time. Indeed, their complexity restricts the exhaustive verification of their models runtime only to relatively small examples. Here, we pursue a complementary approach by introducing the Spatio-Temporal Reach and Escape Logic (STREL), a novel formal specification language that enables to express in a concise way complex spatio-temporal requirements and to monitor them for the first time (to the best of our knowledge) over the execution of mobile and spatially distributed CPS.

The idea of the proposed framework stems from the attempt to generalise and to overcome some limitations of the Spatio-Signal Temporal Logic (SSTL) previously introduced in (NenziBCLM15). SSTL extends the Signal Temporal Logic (MalerN13) with modalities (named somewhere and surround) to express also spatial properties and it is interpreted over a discrete model of the space, represented as a finite undirected graph. Each node represents a location in the space, characterised by a set of signals whose evolution can be observed in time, while each edge of the graph is labelled with a positive weight, that can be used to represent the distance between two nodes. This provides a metric structure to the space in terms of shortest path distances, enabling to monitor also spatial properties. However, since the topology of the graph in SSTL is assumed to be static, one main limitation is the impossibility to monitor nodes changing locations. Furthermore, monitoring of spatial properties is performed on each location by changing the graph so to consider only the locations that satisfy the distance constraint. This means that, the monitoring results of a location cannot be reused in the monitoring of its neighbours. In this work, we decide to completely reformulate the spatial modalities changing the perspective: instead of searching locations satisfying properties within a certain distance using the shortest path, the satisfaction of a location can be obtained by using monitored values obtained from the directly connected locations.

In particular, STREL generalizes SSTL by considering two new operators, named reach and escape. These new operators simplify the monitoring procedure that can be computed locally: the satisfaction of the property at each location depends only on the satisfaction of its neighboursWe will see in Section 5 that this feature is very important to define distributed and online monitor algorithms.. Furthermore, while SSTL operates on spatio-temporal models that are static (the locations do not change their positions), STREL can handle also mobile/dynamic CPS. We also prove that, for a subclass of models, all the spatial properties expressed with reach and escape, using euclidean distance, satisfy all the transformed models through rotation, reflection and translation.

Another important feature of our logic considered in this paper is that, following an approach similar to the one considered in (LM05), we do not rely on a specific domain for interpreting logical properties. Indeed, STL/SSTL semantics can be either qualitative, ranging over boolean values, or quantitative, ranging over real values. In this paper, we propose both qualitative and quantitative semantics based on Constraint Semirings. These are algebraic structures that consist of a domain and two operations named choose and combine. Constraint semirings have been shown to be very flexible, expressive and convenient for a wide range of problems, in particular for optimization and solving problems with soft constraints and multiple criteria (BMR97). The use of semirings allows the definition of a single monitoring procedure that, being parametric with respect to the class of data collected from devices and values produced as results, can be used with different purposes. We then provide an offline monitoring algorithm for STREL, and, to illustrate the main features of the proposed formal framework, we show its application using the monitoring of a simulated Mobile Ad-hoc sensor NETwork (MANET) as our running example.

We want to stress that STREL is a flexible framework to formulate properties of CPS: the ability of freely mixing spatial and temporal operators to build complex queries, and to automatically construct monitoring algorithms, marks a neat difference from other related approaches, like the development of ad hoc solutions for specific properties.

The rest of this paper is organized as follows. Section 2 discusses the related work. Section 3 introduces the model we consider to represent the spatio-temporal signals, while section 4 provides the syntax and the semantics of STREL. An offline monitoring algorithm and its implementation is then discussed in section 5. In section 6, we show the logic at work on some examples, in particular we consider a MANET as case study. Section 7 draws our conclusions and discusses future works.

2. Related Work

Monitoring spatial-temporal properties over CPS executions was first proposed in (Talcott08) where the author has introduced the notion of spatial-temporal event-based model for CPS. Events are triggered by the execution of actions, by the exchange of messages and by physical changes. Each generated event is labeled with time and space stamps and processed by a monitor. In (TVG09), this concept is further elaborated, developing a spatial-temporal event-based model where the space is represented as a 2D Cartesian coordinate system with location points and location fields.

The approaches described in (Talcott08; TVG09) provide an algorithmic framework enabling a user to develop manually a monitor. However, they do not provide any spatio-temporal logic language enabling the specification and the automatic monitoring generation.

In the field of collective adaptive systems (CianciaLLM16), other mathematical structures, such as topological spaces, closure spaces, quasi-discrete closure spaces and finite graphs (NenziBCLM15), have been considered to reason about spatial relations, such as closeness and neighborhood. Despite these models are suitable for offline and centralised monitoring of model-based simulations, they do not scale well for the runtime monitoring of spatially distributed CPS.

Several logic-based formalisms have been proposed to specify the behavior and the spatial structure of concurrent systems (CC04) and for reasoning about the topological (BC02) or directional (BS10) aspects of the interacting entities. In topological reasoning (BC02), the spatial objects are sets of points and the relation between them is preserved under translation, scaling and rotation. In directional reasoning, the relation between objects depends on their relative position. These logics are usually highly computationally complex (BS10) or even undecidable (MR99).

Monitoring spatial-temporal behaviors has started to receive more attention only recently with SpaTeL (bartocci2015) and SSTL (NenziBCLM15). The Spatial-Temporal Logic (SpaTeL) (bartocci2015) is the unification of Signal Temporal Logic (MalerN13) (STL) and Tree Spatial Superposition Logic (TSSL) introduced in (bartocci2014; Bartocci2016)

to classify and detect spatial patterns. TSSL reasons over quad trees, spatial data structures that are constructed by recursively partitioning the space into uniform quadrants. The notion of superposition in TSSL provides a way to describe statistically the distribution of discrete states in a particular partition of the space and the spatial operators corresponding to

zooming in and out in a particular region of the space. By nesting these operators, it is possible to specify self-similar and fractal-like structures (GrosuSCWEB09) that generally characterize the patterns emerging in nature. The procedure allows one to capture very complex spatial structures, but at the price of a complex formulation of spatial properties, which are in practice only learned from some template image.

Another important work to mention is Voltron (MottolaMWG14), an open-source team-level programming system for drone’s collaborative sensing. Voltron provides special programming constructs to reason about time and space and allows users to express sophisticated collaborative tasks without exposing them to the complexity of concurrent programming, parallel execution, scaling, and failure recovery. The spatial constructs are limited to operate on a set of locations of a given geometry (that the user needs to specify). The system is suitable more for programming than for monitoring. For example, it does not allow to quantify how much the current CPS execution is close to violate a given requirement.

3. Spatial Models, Signals and Traces

In this section, we introduce the model of space we consider, and the type of signals that the logic specifies.

3.1. Constraint Semirings

An elegant and general way to represent the result of monitoring is based on constraint semiring. This is an algebraic structure that consists of a domain and two operations named choose and combine. Constraint semirings are subclass of semirings which have been shown to be very flexible, expressive and convenient for a wide range of problems, in particular for optimisation and solving problems with soft constraints and multiple criteria (BMR97), and in model checking (LM05).

Definition 3.1 (semiring).

A constraint semiring (just semiring in the following) is a tuple composed by a set , two operators , and two constants , such that:

  • is an associative, commutative, idempotent operator to “choose” among valuesWe let to denote ., with ;

  • is an associative, commutative operator to “combine” values;

  • distributes over ;

  • , , , for all ;

  • , which is defined as iff , provides a complete lattice .

We say that a semiring is idempotent if and only if for any . Moreover, we say that a semiring is total when is a total order.

With an abuse of notation we sometimes refer to a semiring with the carrier and to its components by subscripting them with the carrier, i.e., , , and . For the sake of a lighter notation we drop the subscripts if clear from the context.

Example 3.2 ().

Typical examples of semirings that we will use in this paper areWe use (resp. ) to denote (resp. ).:

  • the Boolean semiring ;

  • the tropical semiring ;

  • the max/min semiring: ;

  • the integer semiring: .

Boolean, max/min and integer semirings are idempotent while tropical semiring is not. All the above semirings are total.

One of the advantages of semirings is that these can be easily composed. For instance, if and are two semirings, one can consider the cartesian product where operations are applied elementwise.

3.2. Spatial model

Space is represented via a graph with edges having a weight from a given semiring.

Definition 3.3 ().

Let be a semiring, a spatial model is a pair where:

  • is a set of locations, also named space universe;

  • is a proximity function associating at most one label with each distinct pair .

We will use to denote the set of -spatial models, while indicates the set of -spatial models having as a set of locations. In the following, we will equivalently write as or , saying that is next to with weight .

A special class of spatial models are the ones based on Euclidean spaces.

Definition 3.4 (Euclidean spatial model).

Let be a set of locations, a (reflexive) relation and a function mapping each location to a point in , we let be the -spatial model is the min/max semiring considered in Example 3.2. such that:

Note that we label edges with a 2-dimensional vector

describing how to reach from , i.e., . This obviously allows us to compute the euclidean distance between and as , but, as we will see, allows us to compute the euclidean distance of any pair of locations connected by any path, not necessarily by a line in the plane.

Example 3.5 (Mobile Ad hoc sensor NETwork).

A Mobile Ad-hoc sensor NETwork (MANET) is a sensor network that can consist of up ten thousands of mobile devices connected wirelessly. The devices are usually deployed to monitor environmental changes such as pollution, humidity, light and temperature. Each sensor node can be equipped with a sensing transducer, data processor, a radio transceiver and an embedded battery. It can move independently in any direction and change its links to other devices. Two nodes can communicate each other if their Euclidean distance is at most their communication range as depicted in Fig. 1 (right) . Moreover, the nodes can be of different type and their behaviour and communication can depend on their types.

2. Related Work

Monitoring spatial-temporal properties over CPS executions was first proposed in (Talcott08) where the author has introduced the notion of spatial-temporal event-based model for CPS. Events are triggered by the execution of actions, by the exchange of messages and by physical changes. Each generated event is labeled with time and space stamps and processed by a monitor. In (TVG09), this concept is further elaborated, developing a spatial-temporal event-based model where the space is represented as a 2D Cartesian coordinate system with location points and location fields.

The approaches described in (Talcott08; TVG09) provide an algorithmic framework enabling a user to develop manually a monitor. However, they do not provide any spatio-temporal logic language enabling the specification and the automatic monitoring generation.

In the field of collective adaptive systems (CianciaLLM16), other mathematical structures, such as topological spaces, closure spaces, quasi-discrete closure spaces and finite graphs (NenziBCLM15), have been considered to reason about spatial relations, such as closeness and neighborhood. Despite these models are suitable for offline and centralised monitoring of model-based simulations, they do not scale well for the runtime monitoring of spatially distributed CPS.

Several logic-based formalisms have been proposed to specify the behavior and the spatial structure of concurrent systems (CC04) and for reasoning about the topological (BC02) or directional (BS10) aspects of the interacting entities. In topological reasoning (BC02), the spatial objects are sets of points and the relation between them is preserved under translation, scaling and rotation. In directional reasoning, the relation between objects depends on their relative position. These logics are usually highly computationally complex (BS10) or even undecidable (MR99).

Monitoring spatial-temporal behaviors has started to receive more attention only recently with SpaTeL (bartocci2015) and SSTL (NenziBCLM15). The Spatial-Temporal Logic (SpaTeL) (bartocci2015) is the unification of Signal Temporal Logic (MalerN13) (STL) and Tree Spatial Superposition Logic (TSSL) introduced in (bartocci2014; Bartocci2016)

to classify and detect spatial patterns. TSSL reasons over quad trees, spatial data structures that are constructed by recursively partitioning the space into uniform quadrants. The notion of superposition in TSSL provides a way to describe statistically the distribution of discrete states in a particular partition of the space and the spatial operators corresponding to

zooming in and out in a particular region of the space. By nesting these operators, it is possible to specify self-similar and fractal-like structures (GrosuSCWEB09) that generally characterize the patterns emerging in nature. The procedure allows one to capture very complex spatial structures, but at the price of a complex formulation of spatial properties, which are in practice only learned from some template image.

Another important work to mention is Voltron (MottolaMWG14), an open-source team-level programming system for drone’s collaborative sensing. Voltron provides special programming constructs to reason about time and space and allows users to express sophisticated collaborative tasks without exposing them to the complexity of concurrent programming, parallel execution, scaling, and failure recovery. The spatial constructs are limited to operate on a set of locations of a given geometry (that the user needs to specify). The system is suitable more for programming than for monitoring. For example, it does not allow to quantify how much the current CPS execution is close to violate a given requirement.

3. Spatial Models, Signals and Traces

In this section, we introduce the model of space we consider, and the type of signals that the logic specifies.

3.1. Constraint Semirings

An elegant and general way to represent the result of monitoring is based on constraint semiring. This is an algebraic structure that consists of a domain and two operations named choose and combine. Constraint semirings are subclass of semirings which have been shown to be very flexible, expressive and convenient for a wide range of problems, in particular for optimisation and solving problems with soft constraints and multiple criteria (BMR97), and in model checking (LM05).

Definition 3.1 (semiring).

A constraint semiring (just semiring in the following) is a tuple composed by a set , two operators , and two constants , such that:

  • is an associative, commutative, idempotent operator to “choose” among valuesWe let to denote ., with ;

  • is an associative, commutative operator to “combine” values;

  • distributes over ;

  • , , , for all ;

  • , which is defined as iff , provides a complete lattice .

We say that a semiring is idempotent if and only if for any . Moreover, we say that a semiring is total when is a total order.

With an abuse of notation we sometimes refer to a semiring with the carrier and to its components by subscripting them with the carrier, i.e., , , and . For the sake of a lighter notation we drop the subscripts if clear from the context.

Example 3.2 ().

Typical examples of semirings that we will use in this paper areWe use (resp. ) to denote (resp. ).:

  • the Boolean semiring ;

  • the tropical semiring ;

  • the max/min semiring: ;

  • the integer semiring: .

Boolean, max/min and integer semirings are idempotent while tropical semiring is not. All the above semirings are total.

One of the advantages of semirings is that these can be easily composed. For instance, if and are two semirings, one can consider the cartesian product where operations are applied elementwise.

3.2. Spatial model

Space is represented via a graph with edges having a weight from a given semiring.

Definition 3.3 ().

Let be a semiring, a spatial model is a pair where:

  • is a set of locations, also named space universe;

  • is a proximity function associating at most one label with each distinct pair .

We will use to denote the set of -spatial models, while indicates the set of -spatial models having as a set of locations. In the following, we will equivalently write as or , saying that is next to with weight .

A special class of spatial models are the ones based on Euclidean spaces.

Definition 3.4 (Euclidean spatial model).

Let be a set of locations, a (reflexive) relation and a function mapping each location to a point in , we let be the -spatial model is the min/max semiring considered in Example 3.2. such that:

Note that we label edges with a 2-dimensional vector

describing how to reach from , i.e., . This obviously allows us to compute the euclidean distance between and as , but, as we will see, allows us to compute the euclidean distance of any pair of locations connected by any path, not necessarily by a line in the plane.

Example 3.5 (Mobile Ad hoc sensor NETwork).

A Mobile Ad-hoc sensor NETwork (MANET) is a sensor network that can consist of up ten thousands of mobile devices connected wirelessly. The devices are usually deployed to monitor environmental changes such as pollution, humidity, light and temperature. Each sensor node can be equipped with a sensing transducer, data processor, a radio transceiver and an embedded battery. It can move independently in any direction and change its links to other devices. Two nodes can communicate each other if their Euclidean distance is at most their communication range as depicted in Fig. 1 (right) . Moreover, the nodes can be of different type and their behaviour and communication can depend on their types.

3. Spatial Models, Signals and Traces

In this section, we introduce the model of space we consider, and the type of signals that the logic specifies.

3.1. Constraint Semirings

An elegant and general way to represent the result of monitoring is based on constraint semiring. This is an algebraic structure that consists of a domain and two operations named choose and combine. Constraint semirings are subclass of semirings which have been shown to be very flexible, expressive and convenient for a wide range of problems, in particular for optimisation and solving problems with soft constraints and multiple criteria (BMR97), and in model checking (LM05).

Definition 3.1 (semiring).

A constraint semiring (just semiring in the following) is a tuple composed by a set , two operators , and two constants , such that:

  • is an associative, commutative, idempotent operator to “choose” among valuesWe let to denote ., with ;

  • is an associative, commutative operator to “combine” values;

  • distributes over ;

  • , , , for all ;

  • , which is defined as iff , provides a complete lattice .

We say that a semiring is idempotent if and only if for any . Moreover, we say that a semiring is total when is a total order.

With an abuse of notation we sometimes refer to a semiring with the carrier and to its components by subscripting them with the carrier, i.e., , , and . For the sake of a lighter notation we drop the subscripts if clear from the context.

Example 3.2 ().

Typical examples of semirings that we will use in this paper areWe use (resp. ) to denote (resp. ).:

  • the Boolean semiring ;

  • the tropical semiring ;

  • the max/min semiring: ;

  • the integer semiring: .

Boolean, max/min and integer semirings are idempotent while tropical semiring is not. All the above semirings are total.

One of the advantages of semirings is that these can be easily composed. For instance, if and are two semirings, one can consider the cartesian product where operations are applied elementwise.

3.2. Spatial model

Space is represented via a graph with edges having a weight from a given semiring.

Definition 3.3 ().

Let be a semiring, a spatial model is a pair where:

  • is a set of locations, also named space universe;

  • is a proximity function associating at most one label with each distinct pair .

We will use to denote the set of -spatial models, while indicates the set of -spatial models having as a set of locations. In the following, we will equivalently write as or , saying that is next to with weight .

A special class of spatial models are the ones based on Euclidean spaces.

Definition 3.4 (Euclidean spatial model).

Let be a set of locations, a (reflexive) relation and a function mapping each location to a point in , we let be the -spatial model is the min/max semiring considered in Example 3.2. such that:

Note that we label edges with a 2-dimensional vector

describing how to reach from , i.e., . This obviously allows us to compute the euclidean distance between and as , but, as we will see, allows us to compute the euclidean distance of any pair of locations connected by any path, not necessarily by a line in the plane.

Example 3.5 (Mobile Ad hoc sensor NETwork).

A Mobile Ad-hoc sensor NETwork (MANET) is a sensor network that can consist of up ten thousands of mobile devices connected wirelessly. The devices are usually deployed to monitor environmental changes such as pollution, humidity, light and temperature. Each sensor node can be equipped with a sensing transducer, data processor, a radio transceiver and an embedded battery. It can move independently in any direction and change its links to other devices. Two nodes can communicate each other if their Euclidean distance is at most their communication range as depicted in Fig. 1 (right) . Moreover, the nodes can be of different type and their behaviour and communication can depend on their types.

4. Spatio-temporal Reach and Escape Logic

In this section, we present the Spatio-Temporal Reach and Escape Logic (STREL), an extension of the Signal Temporal Logic. We define the syntax and the semantics of STREL, describing in detail the spatial operators and their expressiveness.

4.1. Syntax

The syntax of STREL is given by

where is an atomic predicate (), negation and conjunction are the standard Boolean connectives, and are the Until and the Since temporal modalities, with a real positive closed interval. These are the standard temporal operators of STL, and we refer the reader to (MalerN13; Donze2013) for more details. The spatial modalities are the reachability and the escape operators, with a Distance Function, (we call their collection), described in the previous section, and a Distance Predicate (from a set of predicates), e.g., inequalitiesWith an abuse of notation, we will denote by the predicate that complements .. The exact meaning of and depends on specific interpretation functions. This because, the monitored value associated with a formula depends on the considered domain. We impose that any occurring in a operator is , i.e., if satisfies and then satisfies . This because predicate represents an upper bound on a distance.

The reachability operator describes the behavior of reaching a location satisfying property passing only through locations that satisfy , through nodes whose distance from the initial location satisfy the predicate . The escape operator , instead, describes the possibility of escaping from a certain region passing only through locations that satisfy , via a route with distance satisfying the predicate . Differently from , in the predicate represents a lower bound. For this reason we assume that any interpretation of is , i.e., if satisfies and then satisfies is if and only if is ..

As customary, we can derive the disjunction operator and the future eventually and always operators from the until temporal modality, and the corresponding past variants from the since temporal modality, see (MalerN13) for details. We can define also other three derived spatial operators: the somewhere and the everywhere that describe behaviors of some or of all locations at a certain distance from a specific point, and the surround that expresses the topological notion of being surrounded by a -region, while being in a -region, with additional metric constraints. A more thorough discussion of the spatial operators will be given after introducing the semantics.

4.2. Semantics

The semantics of STREL is evaluated point-wise at each time and each location. We stress that each STREL formula abstracts from the specific domain used to express the satisfaction value of as well as there is not explicit reference to the semiring used in the spatial model to express weights associated with edges. These, of course, are needed to define the semantics. In the following, we assume that is the domain of the spatio-temporal traces, while is the semiring where the logic is evaluated. Furthermore, is the semiring of weights, and is the semiring in which distance functions take values. To define the semantics, we also need three auxiliary functions. The signal interpretation function permits to translate the input trace in a different -spatio temporal signal, for each atomic proposition in , which will be the input of the monitoring procedure. The function is used to interpret function symbols as proper distance functions, while maps distance predicate symbols into proper predicates.

Definition 4.1 (Semantics).

Let and B be two semirings, and and two signal domains. Let be a space universe, be a spatio-temporal -trace for and the location service associating an A-spatial model at each time in Let , , and be the functions introduced above. The -monitoring function of is recursively defined in Table 1.







Table 1. Monitoring function.

Given a formula , the function corresponds to the evaluation of the formula at time in the location . The choice of and produces different types of semantics. As described in Section  3, we consider two signal domains: and , giving rise to qualitative and quantitative monitoring, correspond respectively to a Boolean answer value and real satisfaction value. We describe the semantics for the Boolean signal domain ( ). We say that satisfies a formula if . The procedure will be exactly the same for different choices of the formula evaluation domain, just operators have to be interpreted according to the chosen semirings and signal domains. We use the following example as the system on which we specify our properties, in particular we will use the graph in Figure 3 to describe the spatial operators.

Example 4.2 (ZigBee protocol).

In Fig. 3, the graph represents a MANET. In particular, we consider the nodes with three different roles such as the ones implemented in the ZigBee protocol: coordinator, router and EndDevice. The Coordinator node , represented in green color in the graph, is unique in each network and is responsible to initialize the network. After the initialisation, the coordinator behaves as a router. The Router node , represented in red color in the graph, acts as a intermediate router, passing on data from other devices. The EndDevice node , represented in blue, can communicate only with a parent node (either the Coordinator or a Router) and it is unable to relay data from other devices. Nodes move in space and the figure corresponds to the spatial configuration at a fixed time . As trace and location service, let us consider a -spatial model as the proximity graph presented in Example 3.5 and a -trace over this graph denoting the kind of node, i.e. if is a coordinator, if is a router, and if is an end node.

Atomic Proposition. Different types of atomic propositions and signal interpretations are admissible. We can simply consider a finite set and an interpretation function iff . E.g., in Fig. 3, we can consider atomic propositions describing the type of node, i.e., the boolean propositions are true if the node is of the corresponding type. In case of real valued signals and of a quantitative interpretation of the logic ( being in this case the real valued max/min semiring), we can consider inequalities for some real function and define .

Negation.

Conjunction.

Until. . As customary, satisfies

5. Monitoring STREL

In this section, we present a monitoring algorithm that can be used to check if a given signal satisfies or not a STREL property. The proposed algorithm follows an offline approach. Indeed, it takes as input the complete spatio-temporal signal together with the property we want to monitor. At the end of this section, we will also briefly discuss a possible alternative approach that can lead to a distributed and online monitoring procedure. In this case, the spatio-temporal signal is not known at the beginning, it is discovered while data are collected from the system during its execution.

5.1. Offline monitor

Offline monitoring is performed via the function that takes as inputs a location service , a trace and a formula and returns the piecewise constant spatio-temporal signal representing the monitoring of . The function also relies on parametrised with respect to functions , and , used to interpret symbols in formulas, and operators , and of signal domain, used to represent satisfaction values.

The function is defined by induction on the syntax of the formulaThis definition is straightforward and, for the sake of readability, we only report it in Appendix, available in the extend version of this article at https://github.com/Quanticol/strel. The spatio-temporal signal resulting from the monitoring of atomic proposition is just obtained by applying function to the trace . The spatio-temporal signals associated with and are obtained by applying operators and to the signals resulting from the monitoring of and from the monitoring of and .

Monitoring of temporal properties, namely and , can be done by using the same approach used in (Donze2013) and (MalerN13). However, while their monitoring relies on classical boolean and arithmetic operators, here the procedure is parametrised with respect to operators and of the considered semiring.

To monitor first the signals and resulting from the monitoring of and are computed. After that, the final result is computed by aggregating the spatial signals and at each time with function , defined in Algoritm 1. This function also takes as parameters the spatial model at time (obtained from the location service), the function used to compute the distances over paths, and the predicate describing the reachability bound. In function , the data structure is iteratively computed. This data structure associates each location with a set of triples . Intuitively, is in after iterations if and only if: can reach with at most -steps with a distance at least ( satisfying ) and a monitored value . At the beginning is initialised to . Moreover, at each iteration, the values in are updated by considering the elements in , for any next to . The loop continues until a fix point is reached. Note that, termination of the algorithm is guaranteed by the fact that is an idempotent semiring and from the fact that, for any , if and then . The result spatial signal associates each location with the value .

Monitoring algorithm for is reported in Algorithm 2, where function is defined. Given a space model at time , a distance function , a distance predicate and a spatial signal, it computes the spatial signal representing the monitoring value of at time . Function iteratively computes the data structure obtained by that associates each location with a set of triples of the form representing the fact that can escape in with a distance and a total value . At each iteration, these values are updated by considering the values in the neighbours in each location. Similarly to function , this computation continues until a fixpoint is reached. After that, the monitored value associated with each location is computed as .

1:inputs: , , , ,
2:
3:
4:while   do
5:     
6:     
7:     for all   do
8:         for all   do
9:              
10:              for all   do
11:                  if  then
12:                       
13:                  else
14:                       
15:                  end if
16:              end for
17:         end for
18:         if   then
19:              
20:         end if
21:     end for
22:     
23:end while
24:
25:for all   do
26:     
27:end for
28:return
Algorithm 1 Function
1:inputs: ,, ,
2:
3:
4:while   do
5:     
6:     
7:     for all   do
8:         for all   do
9:              
10:              for all   do
11:                  if  then
12:                       
13:                  else
14:                       
15:                  end if
16:              end for
17:         end for
18:         if   then
19:              
20:         end if
21:     end for
22:     
23:end while
24:
25:for all   do
26:     
27:end for
28:return
Algorithm 2 Function

Remark. The offline monitoring iteratively computes the monitor value at a location by considering the values of monitoring in the previous iteration. This approach easily enables the definition of a parallel monitoring algorithm. Indeed, both the functions defined in Algorithm 1 and Algorithm 2 can be parallel executed for each location. The different monitoring instances must communicate to exchange the values computed at iteration . Another possible improvement of this algorithm is based on an online computation of the monitoring. Following an approach similar to the one considered in (DDGJJS15), each location can identify its monitoring value by using only partial informations. Early termination of the monitor procedure is then possible when the satisfaction or violation of a property is found.

6. Examples

In this section we present some example of the expressibility and potentiality of STREL.

6.1. ZigBee protocol monitoring

Given a MANET with a ZigBee protocol (Example 4.2), we consider as spatial models both its proximity and connectivity graphs, computed with respect to the Cartesian coordinates. The Nodes have three kinds of roles: coordinator, router and EndDevice, as described in Example 4.2. Moreover, each device is also equipped with a sensor to monitor its battery level (), the humidity () and the pollution () in its position. The semiring is the union between the max/min semiring (for the proximity graph) and the integer semiring (for the connectivity graph). We will use also two types of distances: and the distances described in Example 3.9. As in the Example 4.2, atomic propositions describe the type of nodes. We also consider inequalities on the values that are read from sensors, plus special propositions which encode the address of a specific location, i.e. they are true only in the location .

In the following, we describe several properties of these ZigBee MANET networks that are easily captured by STREL logic, to exemplify its expressive power.

A class of properties naturally encoded in STREL related to the connectivity of the network. First, we can be interested to know if a node is properly connected, meaning that it can reach the coordinator through a path of routers:

(1)

The meaning of this property is that an end node reaches in a step a node which is a router and that is connected to the coordinator via a path of routers.

We may also want to know if there is a path to the router which is reliable in terms of battery levels, for instance such that all routers have a battery level above 30%:

(2)