Monitorability Under Assumptions

Henzinger, Thomas A.; Saraç, N. Ege

doi:10.1007/978-3-030-60508-7_1

Cited by 21 publications

(6 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…monitorable) depending on the information known about the SUA. In fact, as pointed out in [14], the monitorability result w.r.t. a property may change under assumptions on the SUA.…”

Section: ∃ Pz ∀ Pz Cosa F E Sa F E Non Monitorablementioning

confidence: 71%

“…This can be seen on the left branch where we have the possibility to satisfy the property by observing (eventually) ev 2 (positive); while on the right branch, we have the possibility to violate the property by observing something different from ev 4 (negative). Figure 4 Monitorable properties are defined according to Definition 4 in a variety of past research [7,5,20,14,16]. The reason for this is that any other notion of monitorability, such as the one proposed in Definition 3, does not give any guarantees on the monitor used to verify the property.…”

Section: Monitorabilitymentioning

confidence: 99%

See 1 more Smart Citation

Towards Partial Monitoring: It is Always too Soon to Give Up

Ferrando

Cardoso

2021

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

Runtime Verification is a lightweight formal verification technique. It is used to verify at runtime whether the system under analysis behaves as expected. The expected behaviour is usually formally specified by means of properties, which are used to automatically synthesise monitors. A monitor is a device that, given a sequence of events representing a system execution, returns a verdict symbolising the satisfaction or violation of the formal property. Properties that can (resp. cannot) be verified at runtime by a monitor are called monitorable and non-monitorable, respectively. In this paper, we revise the notion of monitorability from a practical perspective, where we show how non-monitorable properties can still be used to generate partial monitors, which can partially check the properties. Finally, we present the implications both from a theoretical and practical perspectives. * Cardoso's work supported by Royal Academy of Engineering under the Chairs in Emerging Technologies scheme.

show abstract

“…monitorable) depending on the information known about the SUA. In fact, as pointed out in [14], the monitorability result w.r.t. a property may change under assumptions on the SUA.…”

Section: ∃ Pz ∀ Pz Cosa F E Sa F E Non Monitorablementioning

confidence: 71%

Section: Monitorabilitymentioning

confidence: 99%

Towards Partial Monitoring: It is Always too Soon to Give Up

Ferrando

Cardoso

2021

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

show abstract

“…Another fruitful direction is devising families of composition functions, which, if fit to joint samples, would provide tight calibration bounds. Finally, a longer-term goal would be to extend the scope of a confidence monitor by considering its temporal behavior and monitoring the assumptions of other monitors [15].…”

Section: Discussionmentioning

confidence: 99%

Confidence Composition for Monitors of Verification Assumptions

Ruchkin¹,

Cleaveland²,

Ivanov³

et al. 2021

Preprint

View full text Add to dashboard Cite

Closed-loop verification of cyber-physical systems with neural network controllers offers strong safety guarantees under certain assumptions. It is, however, difficult to determine whether these guarantees apply at run time because verification assumptions may be violated. To predict safety violations in a verified system, we propose a three-step framework for monitoring the confidence in verification assumptions. First, we represent the sufficient condition for verified safety with a propositional logical formula over assumptions. Second, we build calibrated confidence monitors that evaluate the probability that each assumption holds. Third, we obtain the confidence in the verification guarantees by composing the assumption monitors using a composition function suitable for the logical formula. Our framework provides theoretical bounds on the calibration and conservatism of compositional monitors. In two case studies, we demonstrate that the composed monitors improve over their constituents and successfully predict safety violations.

show abstract

“…For example, a quantitative property class that we have not considered in this work is the limit monitoring of statistical indicators [12]. Other interesting resources that play a role in precisionresource trade-offs are the "speed" or rate of convergence of monitors, that is, how quickly a monitor reaches the desired property value, and "assumptions", that is, prior knowledge about the system or the environment that can be used by the monitor [38], [42]. We also plan to consider the reliability of communication channels [43] and how it relates to monitoring precision.…”

Section: Discussionmentioning

confidence: 99%

“…We believe that such a framework is needed for the systematic study of precision-resource trade-offs in runtime verification. See [36] for a discussion of why quantitative verification at runtime is needed for self-adapting systems, and [37], [38] for monitoring neural networks.…”

Section: Related Workmentioning

confidence: 99%

Quantitative and Approximate Monitoring

Henzinger¹,

Ege²

2021

Preprint

Self Cite

View full text Add to dashboard Cite

In runtime verification, a monitor watches a trace of a system and, if possible, decides after observing each finite prefix whether or not the unknown infinite trace satisfies a given specification. We generalize the theory of runtime verification to monitors that attempt to estimate numerical values of quantitative trace properties (instead of attempting to conclude boolean values of trace specifications), such as maximal or average response time along a trace. Quantitative monitors are approximate: with every finite prefix, they can improve their estimate of the infinite trace's unknown property value. Consequently, quantitative monitors can be compared with regard to a precisioncost trade-off: better approximations of the property value require more monitor resources, such as states (in the case of finite-state monitors) or registers, and additional resources yield better approximations. We introduce a formal framework for quantitative and approximate monitoring, show how it conservatively generalizes the classical boolean setting for monitoring, and give several precision-cost trade-offs for monitors. For example, we prove that there are quantitative properties for which every additional register improves monitoring precision.

show abstract

Monitorability Under Assumptions

Cited by 21 publications

References 17 publications

Towards Partial Monitoring: It is Always too Soon to Give Up

Towards Partial Monitoring: It is Always too Soon to Give Up

Confidence Composition for Monitors of Verification Assumptions

Quantitative and Approximate Monitoring

Contact Info

Product

Resources

About