Fig. 2

Flow chart representing the local monitoring algorithm. Input events are highlighted in yellow. Figure 2 presents the steps the local monitoring algorithm takes to decide whether a command should be executed or whether a sensor reading is consistent. It consists of two main loops: one is triggered by the input event of a command and the other by the input event of a sensor reading. Event checks are triggered upon the occurrence of the respective input, as described in Tables 2 and 3. Depending on the outcomes of those checks, different paths are taken in the flow chart. If a reading is consistent and safe, the internal state of the model is updated. Otherwise an alert is additionally triggered. For commands, if the precomputed state is unsafe, the command is discarded and an alert is issued. Only if the checks yield that the command can safely be executed, it is issued to the respective actuators