Introduce Runtime Verification Monitors V2

[paolonig]

In the Safety Architecture working group we are investigating the adoption of runtime verification monitors as a possibity to qualify the Kernel against specific safety claims. This commit:

• create a new working area for runtime verification monitors
• introduce the initial study performed by the working group

This pull request also addresses all comments from #13

[igor-stoppa]

I think I mentioned this earlier at some point, but it probably got lost.
So I'll say it again:

The RVM is fine and dandy for performing tasks that are assuming everything works more or less fine.
However, from a safety perspective, it has really a lot of dependency, and - if I remember correctly - it even relies on runtime patching of the kernel code.

So, while in principle the idea of performing verification is sound, it's the implementation that I find questionable.

I guess it can be summarised with the infamous "who polices the police?" motto.

I would like to see an answer to this question.

To speed up the conversation, one way forward could be to introduce the problem I described within the document, and then to proceed with a detailed anaylsis, that could be added to the document.

Eventually, it sohuld be possible to draw a conclusion.

Perhaps, it would be more appropriate to talk about kernel self-monitoring, and then to list the desired requirements.

The RVM might or might not fit the bill, but at least it would be possible to perform an objective evaluation, instead of starting from a pre-defined unverified solution.

[paolonig]

As discussed in the Safety Arch WG meeting on Sept 24th. We'll write a separate file explaining which requirements, in general, shall be satisfied by a Kernel monitor.
This can be used as a reference benchmark against which different monitoring solutions can be assessed (including the RV monitor).