We introduce a formal notation for the processing of event traces called Stream Logic (SL). A monitor evaluates a Boolean condition over an input trace, while a filter outputs events from an input trace depending on some monitor's verdict; both constructs can be freely composed. We show how all operators of Linear Temporal Logic, as well as the parametric slicing of an input trace, can be written as Stream Logic constructs.
Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)
1. Runtime Monitoring of
Stream Logic Formulæ
Sylvain Hallé and Raphaël Khoury
Fonds de recherche
sur la nature
et les technologies
CRSNG
NSERC
Université du Québec à Chicoutimi, Canada
27. The output of monitors can be combined using
the usual logical connectives
φ ∧ ψ
T
T
. . .φ
∧
ψ T
T
. . .
28. Inputs and outputs may be delayed: the notation
induces an implicit buffering
T T . . .φ
∧
ψ T . . .
Processing advances in discrete steps: an event is
either produced or not at step n
=> delays != processing time
T
1 2
T
T
3
1 2 3
T
29. A filter takes as input an event trace and a monitor.
It outputs event n if and only if the n-th output of its
monitor is true.
. . .
φ
∞
∞
φa c d a d
31. ∞
c ∨ d
Output all events that satisfy c or d
∞
c
1 : T
Output the first event that satisfies c
c2 :
T
1
))b ∧
: T
Monitor "some b is
immediately followed
by a c"
32. Linear Temporal Logic can be recursively
mapped into filters and monitors
μ(φ)
1
: Tμ(F φ) =
μ(X φ) = μ(φ)
2
:
T
μ(φ U ψ) = μ(¬φ)
1
:
T
μ(ψ)
1
: T∧1
G φ F ψwhichever
comes first
33. A call to next must be followed by a call
to hasNext
No CartCreate request can occur
before a LoginResponse message
A received order must eventually
be shipped
Three successive login attempts should
trigger an alarm
G (next → X hasNext)
¬ CartCreate U hasNext
G (receive → F ship)
G ¬(fail ∧ (X (fail ∧ X fail)))
34. A few identities can be applied...
1
:
T
1
:
T
p
1
:
T
T
ϵ :
T
ϵ
35. A few identities can be applied...
1
:
T
1
:
T
p
1
:
T
T
ϵ :
T
ϵ
36. A few identities can be applied...
1
:
T
1
:
T
p
1
:
T
T
ϵ :
T
ϵ
37. A few identities can be applied...
1
:
T
1
:
T
p
1
:
T
T
ϵ :
T
ϵ
38. A few identities can be applied...
1
:
T
1
:
T
p
1
:
T
T
ϵ :
T
ϵ
μ(G F p) =
= the empty trace