$1.$Consider a dashboard display that displays "normal" when brakes in the car operate normally and "emergency" when there is a failure. The intended behavior is that once "emergency" has been displayed, "normal" will not again be displayed. That is$,$ "emergency" remains on the display until the system is reset.

In the following code, assume that the variable display defines what is displayed. Whatever its value, that is what appears on the dashboard.

volatile static uint$8\_$t alerted; volatile static char$*$ display; void ISRA$()\{$

if alerted $=0$

display $=$ "normal";

$\}$

$\}$

void

display $=$ "emergency";

alerted $=1_{{?}_{?}}$

$\}$

void main$()\{$

alerted $=0_{{?}_{?}}$

$...$set up interrupts...

$...$enable interrupts...

Assume that ISRA is an interrupt service routine that is invoked when the brakes are applied by the driver. Assume that ISRB is invoked if a sensor indicates that the brakes are being applied at the same time that the accelerator pedal is depressed. Assume that neither ISR can interrupt itself, but that ISRBhas higher priority than ISRA, and hence ISRBcan interrupt ISRA, but ISRAcannot interrupt ISRB. Assume further $($unrealistically$)$ that each line of code is atomic.

$($a$)$ Does this program always exhibit the intended behavior? Explain. In the remaining parts of this problem, you will construct various models that will either demonstrate that the behavior is correct or will illustrate how it can be incorrect.

$($b$)$ Construct a determinate extended state machine modeling ISRA. Assume that:

alerted is a variable of type $\{0,1\}sub$ uint $8$ t $,$ there is a pure input A that when present indicates an interrupt request for ISRA, and

display is an output of type char$*.$

$($c$)$ Give the size of the state space for your solution.

$($d$)$ Explain your assumptions about when the state machine in $($b$)$ reacts. Is this time triggered, event triggered, or neither?

$($e$)$ Construct a determinate extended state machine modeling ISRB. This one has a pure input $B$ that when present indicates an interrupt request for ISRB.

$($f$)$ Construct a flat $($non$-$hierarchical$)$ determinate extended state machine describing the joint operation of these two ISRs. Use your model to argue the correctness of your answer to part $($a$).$

$($g$)$ Give an equivalent hierarchical state machine. Use your model to argue the correctness of your answer to part $($a$).$