usphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget./translations/zh_CN/trace/rv/monitor_synthesismodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget./translations/zh_TW/trace/rv/monitor_synthesismodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget./translations/it_IT/trace/rv/monitor_synthesismodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget./translations/ja_JP/trace/rv/monitor_synthesismodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget./translations/ko_KR/trace/rv/monitor_synthesismodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget./translations/sp_SP/trace/rv/monitor_synthesismodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhsection)}(hhh](htitle)}(h&Runtime Verification Monitor Synthesish]h&Runtime Verification Monitor Synthesis}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhH/var/lib/git/docbuild/linux/Documentation/trace/rv/monitor_synthesis.rsthKubh paragraph)}(hThe starting point for the application of runtime verification (RV) techniques is the *specification* or *modeling* of the desired (or undesired) behavior of the system under scrutiny.h](hVThe starting point for the application of runtime verification (RV) techniques is the }(hhhhhNhNubhemphasis)}(h*specification*h]h specification}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhubh or }(hhhhhNhNubh)}(h *modeling*h]hmodeling}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhubhE of the desired (or undesired) behavior of the system under scrutiny.}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hXThe formal representation needs to be then *synthesized* into a *monitor* that can then be used in the analysis of the trace of the system. The *monitor* connects to the system via an *instrumentation* that converts the events from the *system* to the events of the *specification*.h](h+The formal representation needs to be then }(hhhhhNhNubh)}(h *synthesized*h]h synthesized}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhubh into a }(hhhhhNhNubh)}(h *monitor*h]hmonitor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhubhG that can then be used in the analysis of the trace of the system. The }(hhhhhNhNubh)}(h *monitor*h]hmonitor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhubh connects to the system via an }(hhhhhNhNubh)}(h*instrumentation*h]hinstrumentation}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhubh# that converts the events from the }(hhhhhNhNubh)}(h*system*h]hsystem}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhubh to the events of the }(hhhhhNhNubh)}(h*specification*h]h specification}(hjOhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhubh.}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hXsIn Linux terms, the runtime verification monitors are encapsulated inside the *RV monitor* abstraction. The RV monitor includes a set of instances of the monitor (per-cpu monitor, per-task monitor, and so on), the helper functions that glue the monitor to the system reference model, and the trace output as a reaction to event parsing and exceptions, as depicted below::h](hNIn Linux terms, the runtime verification monitors are encapsulated inside the }(hjghhhNhNubh)}(h *RV monitor*h]h RV monitor}(hjohhhNhNubah}(h]h ]h"]h$]h&]uh1hhjgubhX abstraction. The RV monitor includes a set of instances of the monitor (per-cpu monitor, per-task monitor, and so on), the helper functions that glue the monitor to the system reference model, and the trace output as a reaction to event parsing and exceptions, as depicted below:}(hjghhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh literal_block)}(hX<Linux +----- RV Monitor ----------------------------------+ Formal Realm | | Realm +-------------------+ +----------------+ +-----------------+ | Linux kernel | | Monitor | | Reference | | Tracing | -> | Instance(s) | <- | Model | | (instrumentation) | | (verification) | | (specification) | +-------------------+ +----------------+ +-----------------+ | | | | V | | +----------+ | | | Reaction | | | +--+--+--+-+ | | | | | | | | | +-> trace output ? | +------------------------|--|----------------------+ | +----> panic ? +-------> h]hX<Linux +----- RV Monitor ----------------------------------+ Formal Realm | | Realm +-------------------+ +----------------+ +-----------------+ | Linux kernel | | Monitor | | Reference | | Tracing | -> | Instance(s) | <- | Model | | (instrumentation) | | (verification) | | (specification) | +-------------------+ +----------------+ +-----------------+ | | | | V | | +----------+ | | | Reaction | | | +--+--+--+-+ | | | | | | | | | +-> trace output ? | +------------------------|--|----------------------+ | +----> panic ? +-------> }hjsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1jhhhKhhhhubh)}(hhh](h)}(hRV monitor synthesish]hRV monitor synthesis}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK(ubh)}(hThe synthesis of a specification into the Linux *RV monitor* abstraction is automated by the rvgen tool and the header file containing common code for creating monitors. The header files are:h](h0The synthesis of a specification into the Linux }(hjhhhNhNubh)}(h *RV monitor*h]h RV monitor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh abstraction is automated by the rvgen tool and the header file containing common code for creating monitors. The header files are:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK*hjhhubh block_quote)}(hm* rv/da_monitor.h for deterministic automaton monitor. * rv/ltl_monitor.h for linear temporal logic monitor. h]h bullet_list)}(hhh](h list_item)}(h4rv/da_monitor.h for deterministic automaton monitor.h]h)}(hjh]h4rv/da_monitor.h for deterministic automaton monitor.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK.hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h4rv/ltl_monitor.h for linear temporal logic monitor. h]h)}(h3rv/ltl_monitor.h for linear temporal logic monitor.h]h3rv/ltl_monitor.h for linear temporal logic monitor.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK/hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]bullet*uh1jhhhK.hjubah}(h]h ]h"]h$]h&]uh1jhhhK.hjhhubeh}(h]rv-monitor-synthesisah ]h"]rv monitor synthesisah$]h&]uh1hhhhhhhhK(ubh)}(hhh](h)}(hrvgenh]hrvgen}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK2ubh)}(hvThe rvgen utility converts a specification into the C presentation and creating the skeleton of a kernel monitor in C.h]hvThe rvgen utility converts a specification into the C presentation and creating the skeleton of a kernel monitor in C.}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK4hjhhubh)}(h}For example, it is possible to transform the wip.dot model present in [1] into a per-cpu monitor with the following command::h]h|For example, it is possible to transform the wip.dot model present in [1] into a per-cpu monitor with the following command:}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK7hjhhubj)}(h+$ rvgen monitor -c da -s wip.dot -t per_cpuh]h+$ rvgen monitor -c da -s wip.dot -t per_cpu}hjIsbah}(h]h ]h"]h$]h&]jjuh1jhhhK:hjhhubh)}(hAThis will create a directory named wip/ with the following files:h]hAThis will create a directory named wip/ with the following files:}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhubah}(h]h ]h"]h$]h&]uh1jhjehhhhhNubj)}(hwip.c: the RV monitor h]h)}(hwip.c: the RV monitorh]hwip.c: the RV monitor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK?hjubah}(h]h ]h"]h$]h&]uh1jhjehhhhhNubeh}(h]h ]h"]h$]h&]j -uh1jhhhK>hjhhubh)}(hfThe wip.c file contains the monitor declaration and the starting point for the system instrumentation.h]hfThe wip.c file contains the monitor declaration and the starting point for the system instrumentation.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKAhjhhubh)}(hXSimilarly, a linear temporal logic monitor can be generated with the following command::h]hWSimilarly, a linear temporal logic monitor can be generated with the following command:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKDhjhhubj)}(h3$ rvgen monitor -c ltl -s pagefault.ltl -t per_taskh]h3$ rvgen monitor -c ltl -s pagefault.ltl -t per_task}hjsbah}(h]h ]h"]h$]h&]jjuh1jhhhKGhjhhubh)}(h)This generates pagefault/ directory with:h]h)This generates pagefault/ directory with:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhjhhubj)}(hhh](j)}(hbpagefault.h: The Buchi automaton (the non-deterministic state machine to verify the specification)h]h)}(hbpagefault.h: The Buchi automaton (the non-deterministic state machine to verify the specification)h]hbpagefault.h: The Buchi automaton (the non-deterministic state machine to verify the specification)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(h-pagefault.c: The skeleton for the RV monitor h]h)}(h,pagefault.c: The skeleton for the RV monitorh]h,pagefault.c: The skeleton for the RV monitor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKMhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]j juh1jhhhKKhjhhubeh}(h]rvgenah ]h"]rvgenah$]h&]uh1hhhhhhhhK2ubh)}(hhh](h)}(hMonitor header filesh]hMonitor header files}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKPubh)}(hThe header files:h]hThe header files:}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKRhjhhubj)}(hhh](j)}(h5`rv/da_monitor.h` for deterministic automaton monitorh]h)}(hj;h](htitle_reference)}(h`rv/da_monitor.h`h]hrv/da_monitor.h}(hjBhhhNhNubah}(h]h ]h"]h$]h&]uh1j@hj=ubh$ for deterministic automaton monitor}(hj=hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKThj9ubah}(h]h ]h"]h$]h&]uh1jhj6hhhhhNubj)}(h3`rv/ltl_monitor` for linear temporal logic monitor h]h)}(h2`rv/ltl_monitor` for linear temporal logic monitorh](jA)}(h`rv/ltl_monitor`h]hrv/ltl_monitor}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1j@hjdubh" for linear temporal logic monitor}(hjdhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKUhj`ubah}(h]h ]h"]h$]h&]uh1jhj6hhhhhNubeh}(h]h ]h"]h$]h&]j juh1jhhhKThjhhubh)}(hRinclude common macros and static functions for implementing *Monitor Instance(s)*.h](hhhhNhNubah}(h]h ]h"]h$]h&]uh1j<hj9ubah}(h]h ]h"]h$]h&]uh1hhhhKghj5ubah}(h]h ]h"]h$]h&]uh1jhj2hhhhhNubj)}(h.``#define DECLARE_DA_MON_PER_CPU(name, type)``h]h)}(hjYh]j=)}(hjYh]h*#define DECLARE_DA_MON_PER_CPU(name, type)}(hj^hhhNhNubah}(h]h ]h"]h$]h&]uh1j<hj[ubah}(h]h ]h"]h$]h&]uh1hhhhKhhjWubah}(h]h ]h"]h$]h&]uh1jhj2hhhhhNubj)}(h0``#define DECLARE_DA_MON_PER_TASK(name, type)`` h]h)}(h/``#define DECLARE_DA_MON_PER_TASK(name, type)``h]j=)}(hj}h]h+#define DECLARE_DA_MON_PER_TASK(name, type)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j<hj{ubah}(h]h ]h"]h$]h&]uh1hhhhKihjwubah}(h]h ]h"]h$]h&]uh1jhj2hhhhhNubeh}(h]h ]h"]h$]h&]j juh1jhhhKghjhhubh)}(hThe first declares the functions for a global deterministic automata monitor, the second for monitors with per-cpu instances, and the third with per-task instances.h]hThe first declares the functions for a global deterministic automata monitor, the second for monitors with per-cpu instances, and the third with per-task instances.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKkhjhhubh)}(hIn all cases, the 'name' argument is a string that identifies the monitor, and the 'type' argument is the data type used by rvgen on the representation of the model in C.h]hIn all cases, the ‘name’ argument is a string that identifies the monitor, and the ‘type’ argument is the data type used by rvgen on the representation of the model in C.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKohjhhubh)}(hFor example, the wip model with two states and three events can be stored in an 'unsigned char' type. Considering that the preemption control is a per-cpu behavior, the monitor declaration in the 'wip.c' file is::h]hFor example, the wip model with two states and three events can be stored in an ‘unsigned char’ type. Considering that the preemption control is a per-cpu behavior, the monitor declaration in the ‘wip.c’ file is:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKshjhhubj)}(h+DECLARE_DA_MON_PER_CPU(wip, unsigned char);h]h+DECLARE_DA_MON_PER_CPU(wip, unsigned char);}hjsbah}(h]h ]h"]h$]h&]jjuh1jhhhKwhjhhubh)}(h]The monitor is executed by sending events to be processed via the functions presented below::h]h\The monitor is executed by sending events to be processed via the functions presented below:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKyhjhhubj)}(hda_handle_event_$(MONITOR_NAME)($(event from event enum)); da_handle_start_event_$(MONITOR_NAME)($(event from event enum)); da_handle_start_run_event_$(MONITOR_NAME)($(event from event enum));h]hda_handle_event_$(MONITOR_NAME)($(event from event enum)); da_handle_start_event_$(MONITOR_NAME)($(event from event enum)); da_handle_start_run_event_$(MONITOR_NAME)($(event from event enum));}hjsbah}(h]h ]h"]h$]h&]jjuh1jhhhK|hjhhubh)}(hThe function ``da_handle_event_$(MONITOR_NAME)()`` is the regular case where the event will be processed if the monitor is processing events.h](h The function }(hjhhhNhNubj=)}(h%``da_handle_event_$(MONITOR_NAME)()``h]h!da_handle_event_$(MONITOR_NAME)()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j<hjubh[ is the regular case where the event will be processed if the monitor is processing events.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hWhen a monitor is enabled, it is placed in the initial state of the automata. However, the monitor does not know if the system is in the *initial state*.h](hWhen a monitor is enabled, it is placed in the initial state of the automata. However, the monitor does not know if the system is in the }(hjhhhNhNubh)}(h*initial state*h]h initial state}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hThe ``da_handle_start_event_$(MONITOR_NAME)()`` function is used to notify the monitor that the system is returning to the initial state, so the monitor can start monitoring the next event.h](hThe }(hj2hhhNhNubj=)}(h+``da_handle_start_event_$(MONITOR_NAME)()``h]h'da_handle_start_event_$(MONITOR_NAME)()}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1j<hj2ubh function is used to notify the monitor that the system is returning to the initial state, so the monitor can start monitoring the next event.}(hj2hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hThe ``da_handle_start_run_event_$(MONITOR_NAME)()`` function is used to notify the monitor that the system is known to be in the initial state, so the monitor can start monitoring and monitor the current event.h](hThe }(hjRhhhNhNubj=)}(h/``da_handle_start_run_event_$(MONITOR_NAME)()``h]h+da_handle_start_run_event_$(MONITOR_NAME)()}(hjZhhhNhNubah}(h]h ]h"]h$]h&]uh1j<hjRubh function is used to notify the monitor that the system is known to be in the initial state, so the monitor can start monitoring and monitor the current event.}(hjRhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hUsing the wip model as example, the events "preempt_disable" and "sched_waking" should be sent to monitor, respectively, via [2]::h]hUsing the wip model as example, the events “preempt_disable” and “sched_waking” should be sent to monitor, respectively, via [2]:}(hjrhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(hPda_handle_event_wip(preempt_disable_wip); da_handle_event_wip(sched_waking_wip);h]hPda_handle_event_wip(preempt_disable_wip); da_handle_event_wip(sched_waking_wip);}hjsbah}(h]h ]h"]h$]h&]jjuh1jhhhKhjhhubh)}(h,While the event "preempt_enabled" will use::h]h/While the event “preempt_enabled” will use:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(h.da_handle_start_event_wip(preempt_enable_wip);h]h.da_handle_start_event_wip(preempt_enable_wip);}hjsbah}(h]h ]h"]h$]h&]jjuh1jhhhKhjhhubh)}(h~To notify the monitor that the system will be returning to the initial state, so the system and the monitor should be in sync.h]h~To notify the monitor that the system will be returning to the initial state, so the system and the monitor should be in sync.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]rv-da-monitor-hah ]h"]rv/da_monitor.hah$]h&]uh1hhjhhhhhKcubh)}(hhh](h)}(hrv/ltl_monitor.hh]hrv/ltl_monitor.h}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hThis file must be combined with the $(MODEL_NAME).h file (generated by `rvgen`) to be complete. For example, for the `pagefault` monitor, the `pagefault.c` source file must include::h](hGThis file must be combined with the $(MODEL_NAME).h file (generated by }(hjhhhNhNubjA)}(h`rvgen`h]hrvgen}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j@hjubh') to be complete. For example, for the }(hjhhhNhNubjA)}(h `pagefault`h]h pagefault}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j@hjubh monitor, the }(hjhhhNhNubjA)}(h `pagefault.c`h]h pagefault.c}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j@hjubh source file must include:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(h2#include "pagefault.h" #include h]h2#include "pagefault.h" #include }hjsbah}(h]h ]h"]h$]h&]jjuh1jhhhKhjhhubh)}(hC(the skeleton monitor file generated by `rvgen` already does this).h](h((the skeleton monitor file generated by }(hj#hhhNhNubjA)}(h`rvgen`h]hrvgen}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1j@hj#ubh already does this).}(hj#hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hXg`$(MODEL_NAME).h` (`pagefault.h` in the above example) includes the implementation of the Buchi automaton - a non-deterministic state machine that verifies the LTL specification. While `rv/ltl_monitor.h` includes the common helper functions to interact with the Buchi automaton and to implement an RV monitor. An important definition in `$(MODEL_NAME).h` is::h](jA)}(h`$(MODEL_NAME).h`h]h$(MODEL_NAME).h}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1j@hjCubh (}(hjChhhNhNubjA)}(h `pagefault.h`h]h pagefault.h}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1j@hjCubh in the above example) includes the implementation of the Buchi automaton - a non-deterministic state machine that verifies the LTL specification. While }(hjChhhNhNubjA)}(h`rv/ltl_monitor.h`h]hrv/ltl_monitor.h}(hjkhhhNhNubah}(h]h ]h"]h$]h&]uh1j@hjCubh includes the common helper functions to interact with the Buchi automaton and to implement an RV monitor. An important definition in }(hjChhhNhNubjA)}(h`$(MODEL_NAME).h`h]h$(MODEL_NAME).h}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1j@hjCubh is:}(hjChhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(hvenum ltl_atom { LTL_$(FIRST_ATOMIC_PROPOSITION), LTL_$(SECOND_ATOMIC_PROPOSITION), ... LTL_NUM_ATOM };h]hvenum ltl_atom { LTL_$(FIRST_ATOMIC_PROPOSITION), LTL_$(SECOND_ATOMIC_PROPOSITION), ... LTL_NUM_ATOM };}hjsbah}(h]h ]h"]h$]h&]jjuh1jhhhKhjhhubh)}(hwhich is the list of atomic propositions present in the LTL specification (prefixed with "LTL\_" to avoid name collision). This `enum` is passed to the functions interacting with the Buchi automaton.h](hwhich is the list of atomic propositions present in the LTL specification (prefixed with “LTL_” to avoid name collision). This }(hjhhhNhNubjA)}(h`enum`h]henum}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j@hjubhA is passed to the functions interacting with the Buchi automaton.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hX)While generating code, `rvgen` cannot understand the meaning of the atomic propositions. Thus, that task is left for manual work. The recommended pratice is adding tracepoints to places where the atomic propositions change; and in the tracepoints' handlers: the Buchi automaton is executed using::h](hWhile generating code, }(hjhhhNhNubjA)}(h`rvgen`h]hrvgen}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j@hjubhX  cannot understand the meaning of the atomic propositions. Thus, that task is left for manual work. The recommended pratice is adding tracepoints to places where the atomic propositions change; and in the tracepoints’ handlers: the Buchi automaton is executed using:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(hNvoid ltl_atom_update(struct task_struct *task, enum ltl_atom atom, bool value)h]hNvoid ltl_atom_update(struct task_struct *task, enum ltl_atom atom, bool value)}hjsbah}(h]h ]h"]h$]h&]jjuh1jhhhKhjhhubh)}(hwhich tells the Buchi automaton that the atomic proposition `atom` is now `value`. The Buchi automaton checks whether the LTL specification is still satisfied, and invokes the monitor's error tracepoint and the reactor if violation is detected.h](h