Lecture Notes in Computer Science 3472

18 Run-Time Verification 543
correctly with respect to formal requirements. MaC uses two different logics
for specifying monitoring scripts and safety requirements. Main phases of the
framework are:
(1) system requirements are formalized and a monitoring script is written; the
monitoring script is used to instrument the code for establishing a mapping
from low-level information to high-level events
(2) at run-time, events generated by the instrumented system are checked with
respect to requirements
MaC Architecture The run-time monitoring and checking architecture consists
of three components: the filter, the event recognizer, and the run-time
checker. The filter extracts low-level information from the system, such as both
value of program variables and time when those variables change their values,
and sends them to the event recognizer. The event recognizer converts received
events into both high-level events and conditions that are sent to the run-time
checker.
Events delivered to the checker have a timestamp which reflects the actual
time of the occurrence of the event. The timestamp enables monitoring of realtime
properties of the system. The run-time checker checks correctness of the
executions according to the requirement specification, events provided from the
event recognizer, and past history. The current prototype of the MaC framework
supports instrumentation and monitoring of Java bytecode.
Events and Conditions Monitoring scripts defined by the Primitive Event
Definition Language (PEDL) are used to specify both the information that is sent
from the filter to the event recognizer, and how this information is transformed
into requirement-level events by the event recognizer. In particular, when an
“interesting” event occurs in the running system, the filter sends a notification
to the event recognizer. Two possible kinds of notification exist: events which
occur instantaneously during the system execution, and conditions which are
information holding for a duration of time. Since events are associated with the
time of their occurrence and conditions are associated to their duration, it is
possible to reason about timing properties of monitored systems.
Sometimes, variables can become undefined because they are out of scope.
To support reasoning even on such variables, a three-valued logic is used for
PEDL: in addition to true and false, formulas can be evaluated to undefined
(thesymbolusedinsuchcaseis⊥).
MaC Logic The logic has two sorts: conditions and events. The syntax of conditions
(C ) and events (E) is as follows, where c is a primitive condition and e
is a primitive event:
C ::= c | defined(C ) | [E, E) | ¬C | C ∨ C | C ∧ C | C ⇒ C
E ::= e |↑C |↓C | E ∨ E | E ∧ E | E when C