Runtime Enforcement of Timed Properties

Abstract

Abstract. Runtime enforcement is a powerful technique to ensure that a running system respects some desired properties. Using an enforcement monitor, an (untrustworthy) input execution (in the form of a sequence of events) is modified into an output sequence that complies to a property. Runtime enforcement has been extensively studied over the last decade in the context of untimed properties. This paper introduces runtime enforcement of timed properties. We revisit the foundations of runtime enforcement when time between events matters. We show how runtime enforcers can be synthesized for any safety or co-safety timed property. Proposed runtime enforcers are time retardant: to produce an output sequence, additional delays are introduced between the events of the input sequence to correct it. Runtime enforcers have been prototyped and our simulation experiments validate their effectiveness.

Optimal enforcement of (timed) properties with uncontrollable events

“…First, as in the untimed case, the order of events might be modified. Thus, previous definitions of transparency (Pinisetty et al, 2012), stating that the output of an enforcement function will eventually be a delayed prefix of the input, can not be used in this situation. Moreover, when delaying some events to have the property satisfied in the future, one must consider the fact that some uncontrollable events could occur at any moment (and cannot be delayed).…”

“…The output obtained with our approach at date t = 4 is (4, Write). (4, Write) whereas the output obtained in (Pinisetty et al, 2012) would be (2, Write).…”

“…In previous work, we introduced runtime enforcement for timed properties (Pinisetty et al, 2012) specified by timed automata (Alur and Dill, 1992). We proposed a model of EMs that work as delayers, that is, mechanisms that are able to delay the input sequence of timed events to correct it.…”

“…We proposed a model of EMs that work as delayers, that is, mechanisms that are able to delay the input sequence of timed events to correct it. While (Pinisetty et al, 2012) proposed synthesis techniques only for safety and cosafety properties, we then generalised the framework to synthesise an enforcement monitor for any regular timed property (Pinisetty et al, 2014b;Pinisetty et al, 2014c). In (Pinisetty et al, 2014a), we considered parametric timed properties, that is timed properties with data-events containing information from the execution of the monitored system.…”

“…Enforcement mechanisms should be sound and transparent, meaning that the output should satisfy the property under consideration and should be as close as possible to the input, respectively. When dealing with timed properties, EMs can act as delayers over the input sequence of events (Pinisetty et al, 2012;Pinisetty et al, 2014b;Pinisetty et al, 2014c). That is, whenever possible, EMs buffer input events for some time and then release them in such a way that the output sequence of events satisfies the property.…”