“…An observer automaton monitors the actions from controllers, and under specified condition moves to a Bad location. Note that using observer automata is a common approach, used for example in [9,18,34]. Composing such an observer with the model enables checking for reachability of bad locations given a set of controllers, thus detecting misbehaviors, using the query A ¬Obs.bad, indicating that for all states in the tree of traces, the location Obs.bad is not part of it.…”