Lecture Notes in Computer Science 3472

18 Run-Time Verification 535
Temporal Logic We briefly recall basic notions of finite trace linear temporal
logic including a recursive definition of the satisfaction relation on a finite
trace and a LTL formula.
The satisfaction relation |= ⊆ Trace × Formula defines when a trace t satisfies
a formula ϕ, written t |= ϕ, and is defined inductively over the structure
of the formula as follows: where p ∈ Prop is any atomic proposition,
head : Trace → Trace and tail : Trace → Trace are two functions taking the
head and the tail of a trace respectively, length is a function returning the length
of a finite trace, ɛ denotes a empty trace and ϕ and ψ are any formulas:
t |= true is always true,
t |= false is always false,
t |= p iff t �= ɛ and head(t) isp,
t |= ϕ ∧ (∨, ⇒, ⇔)ψ iff t |= ϕ and (or, implied, iff) t |= ψ,
t |= ◦ϕ iff t �= ɛ and tail(t) |= ϕ,
t |= ✷ϕ iff (∀ 1 ≤ i ≤ length(t))ti |= ϕ,
t |= ✸ϕ iff (∃ 1 ≤ i ≤ length(t)+1)ti |= ϕ,
t |= ϕ U ψ iff (∃ 1 ≤ i ≤ length(t)+1)ti |= ψ and
(∀ 1 ≤ j < i)tj |= ϕ.
The LTL operators have a slightly different interpretation in the context of
finite traces, though similar in spirit to their standard semantics in classical LTL
with infinite traces. The formula ◦ϕ (next ϕ) holds for a finite trace iff the trace
is nonempty and ϕ holds in the suffix trace starting in the next (second) time
point. The formula ✷ϕ (always ϕ) holdsifϕholds in all time points, while ✸ϕ
(eventually ϕ) holdsifϕholds in present or in some future time point. The
formula ϕ U ψ (ϕ until ψ) holdsifψholds in present or in some future time
point, and until then ϕ holds. As an example illustrating the semantics, the
formula ✷(ϕ ⇒ ✸ψ) holds for a finite trace iff for any time point in the trace it
holds that if ϕ is true then eventually ψ is true.
LTL is widely accepted as reasonably good formalism to express requirements
of reactive systems. However, there is a tricky aspect of specification-based monitoring
which distinguishes it from other formal methods, such as model checking
and theorem proving: the end of trace. Sooner or later, the monitored program
will be stopped and so does its execution trace. At that moment, the observer
needs to make a decision regarding the validity of checked properties. Let us
consider the formula ✷(p ⇒ ✸q). If each p was followed by at least one q during
the monitored execution, then, at some extent one could say that the formula
was satisfied; but one should be aware that this is not a definitive answer because
the formula could have been very well violated in the future if the program had
not been stopped. However, there are LTL properties that give the user absolute
confidence during the monitoring. For example, a violation of a safety property
reflects a clear misbehavior of the monitored program.
In PathExplorer, the fact that the relation |= can be defined recursively in
the context of finite traces is crucial to the development of generic dynamic pro-