[rules-users] Semantic of rules with not and coincide

[IK81]

Dear all,

I am currently stuck with a problem concerning the use of not and 
conincide. I want to analyze a stream of error code events from a set of 
devices and detect the following situations. Every event has a timestamp 
(long), a device id (String) and an error code (String).

What I want to detect is the following
- If I get two events, one with code C1 and one with C2 from a single 
device within 1 minute, it represents a special event combination. The 
order of their appearence is not relevant.
- If I just get C1 (without the C2 within the time frame), just report 
C1
- If I just get C2 (without the C1 within the time frame), just report 
C2


I can successfully detect the special event combination with the 
following rule

rule "Detect combination"
when
     $e1 : Event ($d: device, code == "C1")
     $e2 : Event (device == $d, code == "C2", this coincides [1m] $e1)
then
     ... do some output
end


Then I tried to implement the detection of C1 only as follows

rule "Detect code C1"
when
	$e1 : Event ($d: device, code == "C1")
	not ( $e2 : Event (device == $d, code == "C2", this coincides [1m] 
$e1))
then
     ... do some other output
end

My understanding of the rule is that it should fire, if I get the event 
with code C1 and there is no other event with error code C2 for the same 
device that happens within one minute before and after the C1 event. To 
my surprise, the rule fires immediately when I insert an event with 
error code C1. Shouldn't the implementation wait at least 1 minute to be 
sure that no C2 error event will be inserted?


BTW this is how I insert the events in my test case:

	clock.advanceTime(70,  TimeUnit.SECONDS);
	FactHandle handle1 = ksession.insert( new Event(65000, "A", "C1") );
	ksession.fireAllRules();
	clock.advanceTime( 10, TimeUnit.SECONDS );
	FactHandle handle2 = ksession.insert( new Event(75000, "A", "C2") );
	ksession.fireAllRules();
	clock.advanceTime( 2, TimeUnit.SECONDS );

And this is mainly the output I get:

detected code C1 @ 70000
   event id=44b895e5-7287-404b-8204-3de5690b2360 timestamp=65000 
device=A code=C1
detected combination @ 80000
   event id=44b895e5-7287-404b-8204-3de5690b2360 timestamp=65000 
device=A code=C1
   event id=fc89715b-fc30-4b12-ab31-a3884dcd4886 timestamp=75000 
device=A code=C2

Any ideas concerning an alternative solution are highly welcomed.

Thanks,
Ingo