monitoring decentralized specifications Antoine El-Hokayem Ylis - PowerPoint PPT Presentation

unpredictability ineffjciency (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized monitoring ֒ → Problem statement · General setting · C = { c 0 , . . . , c n } : components · AP = AP 0 ∪ . . . ∪ AP n : atomic propositions, partitioned by C · no central observation point . . . . . . c 1 c i c n AP 1 AP i AP n A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 4

unpredictability ineffjciency (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized monitoring ֒ → Problem statement · General setting · C = { c 0 , . . . , c n } : components · AP = AP 0 ∪ . . . ∪ AP n : atomic propositions, partitioned by C · no central observation point · but monitors attached to components . . . . . . c 1 c i c n AP 1 AP i AP n . . . . . . M 1 M i M n A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 4

unpredictability ineffjciency (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized monitoring ֒ → Problem statement · General setting . . . . . . c 1 c i c n Monitoring specifjcation over AP effjciently? AP 1 AP i AP n . . . . . . M 1 M i M n A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 4

unpredictability ineffjciency (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized monitoring ֒ → Problem statement · General setting · Issues in decentralized monitoring . . . . . . c 1 c i c n Monitoring specifjcation over AP effjciently? AP 1 AP i AP n . . . . . . M 1 M i M n A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 4

unpredictability ineffjciency (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized monitoring ֒ → Problem statement · General setting · Issues in decentralized monitoring · partial views of AP – unknown global state . . . . . . c 1 c i c n Monitoring specifjcation over AP effjciently? AP 1 AP i AP n . . . . . . M 1 M i M n A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 4

unpredictability ineffjciency (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized monitoring ֒ → Problem statement · General setting · Issues in decentralized monitoring · partial views of AP – unknown global state · partial execution of the automaton (evaluation) . . . . . . c 1 c i c n Monitoring specifjcation over AP effjciently? AP 1 AP i AP n . . . . . . M 1 M i M n A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 4

unpredictability ineffjciency (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized monitoring ֒ → Problem statement · General setting · Issues in decentralized monitoring · partial views of AP – unknown global state · partial execution of the automaton (evaluation) · communication between monitors . . . . . . c 1 c i c n Monitoring specifjcation over AP effjciently? AP 1 AP i AP n . . . . . . M 1 M i M n A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 4

unpredictability ineffjciency (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized monitoring ֒ → Problem statement · General setting · Issues in decentralized monitoring · partial views of AP – unknown global state · partial execution of the automaton (evaluation) · communication between monitors · Existing approaches: . . . . . . c 1 c i c n Monitoring specifjcation over AP effjciently? AP 1 AP i AP n . . . . . . M 1 M i M n A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 4

ineffjciency (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized monitoring ֒ → Problem statement · General setting · Issues in decentralized monitoring · partial views of AP – unknown global state · partial execution of the automaton (evaluation) · communication between monitors · Existing approaches: · based on LTL rewriting — unpredictability of monitor performance . . . . . . c 1 c i c n Monitoring specifjcation over AP effjciently? AP 1 AP i AP n . . . . . . M 1 M i M n A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 4

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized monitoring ֒ → Problem statement · General setting · Issues in decentralized monitoring · partial views of AP – unknown global state · partial execution of the automaton (evaluation) · communication between monitors · Existing approaches: · based on LTL rewriting — unpredictability of monitor performance · all monitors check the same specification — ineffjciency . . . . . . c 1 c i c n Monitoring specifjcation over AP effjciently? AP 1 AP i AP n . . . . . . M 1 M i M n A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 4

Automata compare Decentralized 1. predictable 2. Separate (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions goals Define a methodology of design and evaluation of decentralized monitoring A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

Decentralized Automata compare 2. Separate (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions goals Define a methodology of design and evaluation of decentralized monitoring 1. Aim for predictable behavior A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

Decentralized compare 2. Separate (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions goals Define a methodology of design and evaluation of decentralized monitoring 1. Aim for predictable behavior · Move from LTL → Automata A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

Decentralized 2. Separate (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions goals Define a methodology of design and evaluation of decentralized monitoring 1. Aim for predictable behavior · Move from LTL → Automata · Common ground to compare existing (and future) strategies A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

Decentralized (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions goals Define a methodology of design and evaluation of decentralized monitoring 1. Aim for predictable behavior · Move from LTL → Automata · Common ground to compare existing (and future) strategies 2. Separate monitor synthesis from monitoring strategies A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions goals Define a methodology of design and evaluation of decentralized monitoring 1. Aim for predictable behavior · Move from LTL → Automata · Common ground to compare existing (and future) strategies 2. Separate monitor synthesis from monitoring strategies · Centralized specification → Decentralized specification A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions goals Define a methodology of design and evaluation of decentralized monitoring 1. Aim for predictable behavior · Move from LTL → Automata · Common ground to compare existing (and future) strategies 2. Separate monitor synthesis from monitoring strategies · Centralized specification → Decentralized specification · Monitorability of a decentralized specification A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions goals Define a methodology of design and evaluation of decentralized monitoring 1. Aim for predictable behavior · Move from LTL → Automata · Common ground to compare existing (and future) strategies 2. Separate monitor synthesis from monitoring strategies · Centralized specification → Decentralized specification · Monitorability of a decentralized specification · Define a general decentralized monitoring algorithm A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions goals Define a methodology of design and evaluation of decentralized monitoring 1. Aim for predictable behavior · Move from LTL → Automata · Common ground to compare existing (and future) strategies 2. Separate monitor synthesis from monitoring strategies · Centralized specification → Decentralized specification · Monitorability of a decentralized specification · Define a general decentralized monitoring algorithm ⋆ Extend tooling support for the design methodology A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions goals Define a methodology of design and evaluation of decentralized monitoring 1. Aim for predictable behavior · Move from LTL → Automata · Common ground to compare existing (and future) strategies 2. Separate monitor synthesis from monitoring strategies · Centralized specification → Decentralized specification · Monitorability of a decentralized specification · Define a general decentralized monitoring algorithm ⋆ Extend tooling support for the design methodology ⋆ Ensure reproducibility A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions (Decentralized) Monitoring Monitoring with EHE s Monitoring Decentralized Specifjcations The THEMIS Approach Conclusions A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 5

Monitoring with EHE s

add data rewrite simplify fmexibility partial order predictable Atoms Memory (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

add data rewrite simplify order predictable Atoms Memory (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

add data rewrite simplify predictable Atoms Memory (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information · is insensitive to the reception order of information A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

add data rewrite simplify Atoms Memory (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information · is insensitive to the reception order of information · has predictable size and operations A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

rewrite simplify add data Memory (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information · is insensitive to the reception order of information · has predictable size and operations · Atomic propositions → Atoms A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

rewrite simplify Memory (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information · is insensitive to the reception order of information · has predictable size and operations · Atomic propositions → Atoms · Allow algorithms to add data to observations ( enc : AP → Atoms ) A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

rewrite simplify Memory (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information · is insensitive to the reception order of information · has predictable size and operations · Atomic propositions → Atoms · Allow algorithms to add data to observations ( enc : AP → Atoms ) · Ordering information (timestamp, round number, vector clock etc.) A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

rewrite simplify (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information · is insensitive to the reception order of information · has predictable size and operations · Atomic propositions → Atoms · Allow algorithms to add data to observations ( enc : AP → Atoms ) · Ordering information (timestamp, round number, vector clock etc.) · Monitors store Atoms in their Memory A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

rewrite simplify (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information · is insensitive to the reception order of information · has predictable size and operations · Atomic propositions → Atoms · Allow algorithms to add data to observations ( enc : AP → Atoms ) · Ordering information (timestamp, round number, vector clock etc.) · Monitors store Atoms in their Memory · Monitors need to evaluate Expr Atoms A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

simplify (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information · is insensitive to the reception order of information · has predictable size and operations · Atomic propositions → Atoms · Allow algorithms to add data to observations ( enc : AP → Atoms ) · Ordering information (timestamp, round number, vector clock etc.) · Monitors store Atoms in their Memory · Monitors need to evaluate Expr Atoms · rewrite using Memory A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information · is insensitive to the reception order of information · has predictable size and operations · Atomic propositions → Atoms · Allow algorithms to add data to observations ( enc : AP → Atoms ) · Ordering information (timestamp, round number, vector clock etc.) · Monitors store Atoms in their Memory · Monitors need to evaluate Expr Atoms · rewrite using Memory · simplify using Boolean logics (much easier than simplification for LTL) A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Information as Atoms ⋆ Encode the execution as a datastructure that · supports fmexibility when receiving partial information · is insensitive to the reception order of information · has predictable size and operations · Atomic propositions → Atoms · Allow algorithms to add data to observations ( enc : AP → Atoms ) · Ordering information (timestamp, round number, vector clock etc.) · Monitors store Atoms in their Memory · Monitors need to evaluate Expr Atoms · rewrite using Memory · simplify using Boolean logics (much easier than simplification for LTL) Expr Atoms × Mem → B 3 eval ( expr , M ) = simplify ( rw ( expr , M )) eval ( � 1 , t high � ∧ � 2 , fan � , [ � 1 , t high � �→ ⊥ ]) = ⊥ ∧ � 2 , fan � = ⊥ A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 6

timestamp state EHE recursively lazily (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Automata Execution · EHE is a partial function: I : I ( A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 7

state EHE recursively lazily (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Automata Execution · EHE is a partial function: I : N I ( t · For a given timestamp t A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 7

EHE recursively lazily (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Automata Execution · EHE is a partial function: I : N × Q A I ( t , q ) · For a given timestamp t · The automaton is in state q iff A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 7

EHE recursively lazily (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Automata Execution · EHE is a partial function: I : N × Q A → Expr Atoms I ( t , q ) = expr · For a given timestamp t · The automaton is in state q iff · eval ( expr , M ) = ⊤ A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 7

EHE recursively lazily (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Automata Execution · EHE is a partial function: I : N × Q A → Expr Atoms I ( t , q ) = expr · For a given timestamp t · The automaton is in state q iff · eval ( expr , M ) = ⊤ ¬ t high fan ∧ t high t high I ( 2 , q 0 ) = [ ¬� 1 , t high � ∧ ¬� 2 , t high � ] q 0 q 1 ∨ [ � 1 , t high � ∧ ( � 2 , fan � ∧ ¬� 2 , t high � )] ¬ fan fan ∧ ¬ t high ⊤ q 2 A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 7

EHE recursively lazily (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Automata Execution · EHE is a partial function: I : N × Q A → Expr Atoms I ( t , q ) = expr · For a given timestamp t · The automaton is in state q iff · eval ( expr , M ) = ⊤ ¬ t high fan ∧ t high t high I ( 2 , q 0 ) = [ ¬� 1 , t high � ∧ ¬� 2 , t high � ] q 0 q 1 ∨ [ � 1 , t high � ∧ ( � 2 , fan � ∧ ¬� 2 , t high � )] ¬ fan fan ∧ ¬ t high eval ( I ( 2 , q 0 ) , [ � 1 , t high � �→ ⊥ ]) ⊤ q 2 = eval ( ¬� 2 , t high � , . . . ) = ? A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 7

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Automata Execution · EHE is a partial function: I : N × Q A → Expr Atoms I ( t , q ) = expr · For a given timestamp t · The automaton is in state q iff · eval ( expr , M ) = ⊤ ¬ t high fan ∧ t high t high I ( 2 , q 0 ) = [ ¬� 1 , t high � ∧ ¬� 2 , t high � ] q 0 q 1 ∨ [ � 1 , t high � ∧ ( � 2 , fan � ∧ ¬� 2 , t high � )] ¬ fan fan ∧ ¬ t high eval ( I ( 2 , q 0 ) , [ � 1 , t high � �→ ⊥ ]) ⊤ q 2 = eval ( ¬� 2 , t high � , . . . ) = ? · EHE is constructed recursively and lazily (as needed and on-the-fly) using A A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 7

1 1 2 2 (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Construction I 2 = mov ([ 0 �→ q 0 �→ ⊤ ] , 0 , 2 ) ¬ a ∧ ¬ b ⊤ a ∨ b q 0 q 1 t q expr 0 q 0 ⊤ A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 8

1 1 2 2 (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Construction I 2 = mov ([ 0 �→ q 0 �→ ⊤ ] , 0 , 2 ) ¬ a ∧ ¬ b ⊤ a ∨ b q 0 q 1 t q expr 0 q 0 ⊤ A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 8

2 2 (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Construction I 2 = mov ([ 0 �→ q 0 �→ ⊤ ] , 0 , 2 ) ¬ a ∧ ¬ b ⊤ a ∨ b q 0 q 1 t q expr 0 q 0 ⊤ 1 q 0 1 q 1 A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 8

2 2 (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Construction I 2 = mov ([ 0 �→ q 0 �→ ⊤ ] , 0 , 2 ) ¬ a ∧ ¬ b ⊤ a ∨ b q 0 q 1 t q expr 0 q 0 ⊤ 1 q 0 ⊤ ∧ ¬� 1 , a � ∧ ¬� 1 , b � 1 q 1 A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 8

2 2 (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Construction I 2 = mov ([ 0 �→ q 0 �→ ⊤ ] , 0 , 2 ) ¬ a ∧ ¬ b ⊤ a ∨ b q 0 q 1 t q expr 0 q 0 ⊤ 1 q 0 ¬� 1 , a � ∧ ¬� 1 , b � 1 q 1 � 1 , a � ∨ � 1 , b � A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 8

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Construction I 2 = mov ([ 0 �→ q 0 �→ ⊤ ] , 0 , 2 ) ¬ a ∧ ¬ b ⊤ a ∨ b q 0 q 1 t q expr 0 q 0 ⊤ 1 q 0 ¬� 1 , a � ∧ ¬� 1 , b � 1 q 1 � 1 , a � ∨ � 1 , b � 2 q 0 2 q 1 A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 8

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Construction I 2 = mov ([ 0 �→ q 0 �→ ⊤ ] , 0 , 2 ) ¬ a ∧ ¬ b ⊤ a ∨ b q 0 q 1 t q expr 0 q 0 ⊤ 1 q 0 ¬� 1 , a � ∧ ¬� 1 , b � 1 q 1 � 1 , a � ∨ � 1 , b � 2 q 0 ( ¬� 1 , a � ∧ ¬� 1 , b � ) 2 q 1 . . . A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 8

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Construction I 2 = mov ([ 0 �→ q 0 �→ ⊤ ] , 0 , 2 ) ¬ a ∧ ¬ b ⊤ a ∨ b q 0 q 1 t q expr 0 q 0 ⊤ 1 q 0 ¬� 1 , a � ∧ ¬� 1 , b � 1 q 1 � 1 , a � ∨ � 1 , b � 2 q 0 ( ¬� 1 , a � ∧ ¬� 1 , b � ) ∧ ( ¬� 2 , a � ∧ ¬� 2 , b � ) 2 q 1 . . . A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 8

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Construction I 2 = mov ([ 0 �→ q 0 �→ ⊤ ] , 0 , 2 ) ¬ a ∧ ¬ b ⊤ a ∨ b q 0 q 1 t q expr 0 q 0 ⊤ 1 q 0 ¬� 1 , a � ∧ ¬� 1 , b � 1 q 1 � 1 , a � ∨ � 1 , b � 2 q 0 ( ¬� 1 , a � ∧ ¬� 1 , b � ) ∧ ( ¬� 2 , a � ∧ ¬� 2 , b � ) 2 q 1 [( ¬� 1 , a � ∧ ¬� 1 , b � ) ] ∨ [( � 1 , a � ∨ � 1 , b � ) ] . . . A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 8

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Construction I 2 = mov ([ 0 �→ q 0 �→ ⊤ ] , 0 , 2 ) ¬ a ∧ ¬ b ⊤ a ∨ b q 0 q 1 t q expr 0 q 0 ⊤ 1 q 0 ¬� 1 , a � ∧ ¬� 1 , b � 1 q 1 � 1 , a � ∨ � 1 , b � 2 q 0 ( ¬� 1 , a � ∧ ¬� 1 , b � ) ∧ ( ¬� 2 , a � ∧ ¬� 2 , b � ) 2 q 1 [( ¬� 1 , a � ∧ ¬� 1 , b � ) ∧ ( � 2 , a � ∨ � 2 , b � )] ∨ [( � 1 , a � ∨ � 1 , b � ) ∧ ⊤ ] . . . A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 8

EHE EHE EHE same centralized multiple potential past potential assess EHE EHE 2. Strong Eventual Consistency 3. (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

EHE EHE EHE same centralized multiple potential past potential assess EHE 2. Strong Eventual Consistency 3. (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

EHE EHE EHE same centralized multiple potential past potential assess EHE 2. Strong Eventual Consistency 3. (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

potential past potential assess EHE EHE EHE EHE same centralized multiple 3. (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict 2. Strong Eventual Consistency (SEC) A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

potential past potential assess EHE EHE EHE same centralized multiple 3. (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict 2. Strong Eventual Consistency (SEC) · We can merge EHE s by disjoining ( ∨ ) each entry � t , q � A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

potential past potential assess EHE EHE EHE same centralized multiple 3. (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict 2. Strong Eventual Consistency (SEC) · We can merge EHE s by disjoining ( ∨ ) each entry � t , q � · ∨ is commutative, associative and idempotent A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

potential past potential assess EHE EHE same centralized multiple 3. (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict 2. Strong Eventual Consistency (SEC) · We can merge EHE s by disjoining ( ∨ ) each entry � t , q � · ∨ is commutative, associative and idempotent → EHE is a state-based replicated data-type (CvRDT) A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

potential past potential assess EHE centralized multiple 3. (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict 2. Strong Eventual Consistency (SEC) · We can merge EHE s by disjoining ( ∨ ) each entry � t , q � · ∨ is commutative, associative and idempotent → EHE is a state-based replicated data-type (CvRDT) → Monitors that exchange their EHE find the same verdict A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

potential past potential assess EHE 3. (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict 2. Strong Eventual Consistency (SEC) · We can merge EHE s by disjoining ( ∨ ) each entry � t , q � · ∨ is commutative, associative and idempotent → EHE is a state-based replicated data-type (CvRDT) → Monitors that exchange their EHE find the same verdict → Can monitor centralized specification shared with multiple monitors A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

potential past potential assess EHE (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict 2. Strong Eventual Consistency (SEC) · We can merge EHE s by disjoining ( ∨ ) each entry � t , q � · ∨ is commutative, associative and idempotent → EHE is a state-based replicated data-type (CvRDT) → Monitors that exchange their EHE find the same verdict → Can monitor centralized specification shared with multiple monitors 3. Predictable size A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

potential assess EHE (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict 2. Strong Eventual Consistency (SEC) · We can merge EHE s by disjoining ( ∨ ) each entry � t , q � · ∨ is commutative, associative and idempotent → EHE is a state-based replicated data-type (CvRDT) → Monitors that exchange their EHE find the same verdict → Can monitor centralized specification shared with multiple monitors 3. Predictable size · The EHE encodes all potential and past states, as needed A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

assess EHE (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict 2. Strong Eventual Consistency (SEC) · We can merge EHE s by disjoining ( ∨ ) each entry � t , q � · ∨ is commutative, associative and idempotent → EHE is a state-based replicated data-type (CvRDT) → Monitors that exchange their EHE find the same verdict → Can monitor centralized specification shared with multiple monitors 3. Predictable size · The EHE encodes all potential and past states, as needed · The more we keep track of potential states, the bigger the size A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Properties 1. Soundness (provided that observations can be totally ordered) · For the same trace, EHE and A report the same state → They find the same verdict 2. Strong Eventual Consistency (SEC) · We can merge EHE s by disjoining ( ∨ ) each entry � t , q � · ∨ is commutative, associative and idempotent → EHE is a state-based replicated data-type (CvRDT) → Monitors that exchange their EHE find the same verdict → Can monitor centralized specification shared with multiple monitors 3. Predictable size · The EHE encodes all potential and past states, as needed · The more we keep track of potential states, the bigger the size → We can assess algorithms by how they manipulate the EHE A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 9

determining Potential grows EHE (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Analysis t �→ q �→ ⊤   q 0 �→ e 10     q 1 �→ e 11        . t + 1 �→  .  .        q | Q |− 1 �→ e 1 ( | Q |− 1 )           q 0 �→ e 20     .    . t + 2 �→  .  �→ e 2 ( | Q |− 1 ) q | Q |− 1     .  .  .      q 0 �→ e δ 0        �→ e δ 1 q 1      t + δ �→ .   .  .         q | Q |− 1 �→ e δ ( | Q |− 1 )  A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 10

determining Potential grows EHE (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Analysis t �→ q �→ ⊤   q 0 �→ e 10     q 1 �→ e 11        . t + 1 �→ | Q |  .  .        q | Q |− 1 �→ e 1 ( | Q |− 1 )           q 0 �→ e 20     .    . t + 2 �→ | Q |  .  �→ e 2 ( | Q |− 1 ) q | Q |− 1     .  .  .      q 0 �→ e δ 0        �→ e δ 1 q 1      t + δ �→ | Q | .   .  .         q | Q |− 1 �→ e δ ( | Q |− 1 )  A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 10

grows EHE (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Analysis · Information Delay ( δ ) t �→ q �→ ⊤ Timestamps needed to   q 0 �→ e 10 expand before     q 1 �→ e 11 determining a state        . t + 1 �→ | Q |  .  .   Potential states to keep      q | Q |− 1 �→ e 1 ( | Q |− 1 )      track of      q 0 �→ e 20     .    . t + 2 �→ | Q |  . δ  �→ e 2 ( | Q |− 1 ) q | Q |− 1     .  .  .      q 0 �→ e δ 0        �→ e δ 1 q 1      t + δ �→ | Q | .   .  .         q | Q |− 1 �→ e δ ( | Q |− 1 )  A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 10

EHE (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Analysis · Information Delay ( δ ) t �→ q �→ ⊤ Timestamps needed to   q 0 �→ e 10 expand before     q 1 �→ e 11 determining a state        . t + 1 �→ | Q |  .  .   Potential states to keep      q | Q |− 1 �→ e 1 ( | Q |− 1 )      track of      q 0 �→ e 20    · Size of expression grows  .    . t + 2 �→ | Q |  . δ with each move beyond t  �→ e 2 ( | Q |− 1 ) q | Q |− 1     .  .  .      q 0 �→ e δ 0        �→ e δ 1 q 1      t + δ �→ | Q | .   .  .         q | Q |− 1 �→ e δ ( | Q |− 1 )  A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 10

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions execution history encoding ֒ → Analysis · Information Delay ( δ ) t �→ q �→ ⊤ Timestamps needed to   q 0 �→ e 10 expand before     q 1 �→ e 11 determining a state        . t + 1 �→ | Q |  .  .   Potential states to keep      q | Q |− 1 �→ e 1 ( | Q |− 1 )      track of      q 0 �→ e 20    · Size of expression grows  .    . t + 2 �→ | Q |  . δ with each move beyond t  �→ e 2 ( | Q |− 1 ) q | Q |− 1     . · Size of EHE :  .  .      q 0 �→ e δ 0   δ     �  �→ e δ 1 |I δ | = O ( δ | Q | q 1 LP )      t + δ �→ | Q | .   . 1  .    = O ( δ 2 | Q | LP )      q | Q |− 1 �→ e δ ( | Q |− 1 )  A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 10

Monitoring Decentralized Specifications

local monitors specifjcation component (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification · Each monitor is associated with a tuple �A , c � A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 11

local monitors component (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification · Each monitor is associated with a tuple �A , c � · A is its specifjcation automaton A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 11

local monitors (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification · Each monitor is associated with a tuple �A , c � · A is its specifjcation automaton · c is the component the monitor is attached to A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 11

local monitors (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification · Each monitor is associated with a tuple �A , c � · A is its specifjcation automaton · c is the component the monitor is attached to · The transition labels of an automaton A are restricted to: A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 11

monitors (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification · Each monitor is associated with a tuple �A , c � · A is its specifjcation automaton · c is the component the monitor is attached to · The transition labels of an automaton A are restricted to: · Atomic propositions local to the attached component A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 11

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification · Each monitor is associated with a tuple �A , c � · A is its specifjcation automaton · c is the component the monitor is attached to · The transition labels of an automaton A are restricted to: · Atomic propositions local to the attached component · References to other monitors A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 11

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification · Each monitor is associated with a tuple �A , c � · A is its specifjcation automaton · c is the component the monitor is attached to · The transition labels of an automaton A are restricted to: · Atomic propositions local to the attached component · References to other monitors ¬ t high fan ∧ t high t high q 0 q 1 fan ∧ ¬ t high ¬ fan ⊤ q 2 A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 11

(Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification · Each monitor is associated with a tuple �A , c � · A is its specifjcation automaton · c is the component the monitor is attached to · The transition labels of an automaton A are restricted to: · Atomic propositions local to the attached component · References to other monitors ¬ t high m 1 ∧ t high ¬ t high fan ∧ t high t high t high fan ⊤ q 0 q 1 q 00 q 01 q 10 q 11 ¬ m 1 m 1 ∧ ¬ t high ¬ fan fan ∧ ¬ t high ¬ fan A 0 A 1 ⊤ ⊤ ⊤ q 2 q 02 q 12 (Temp) (Fan) A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 11

1. taken 2. verdict 3. dependencies expr expr starting verdict not (!) fjnal (?) paths (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification ֒ → Semantics & Monitorability · For an automaton A k , to evaluate a label m j at t with a trace tr A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 12

1. taken 2. verdict 3. dependencies expr expr verdict not (!) fjnal (?) paths (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification ֒ → Semantics & Monitorability · For an automaton A k , to evaluate a label m j at t with a trace tr · Run tr starting with t on A j starting from q j 0 A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 12

1. taken 2. verdict 3. dependencies expr expr not (!) fjnal (?) paths (Decent.) Monitoring EHE Decentralized Specifjcations THEMIS Conclusions decentralized specification ֒ → Semantics & Monitorability · For an automaton A k , to evaluate a label m j at t with a trace tr · Run tr starting with t on A j starting from q j 0 · Consider the verdict of the run to be the observation m j at t A. El-Hokayem, Y. Falcone, Monitoring Decentralized Specifjcations 12