Synthesising Correct Concurrent Runtime Monitors

Abstract

This paper studies the correctness of automated synthesis for concurrent monitors. We adapt a subset of the Hennessy-Milner logic with recursion (a reformulation of the modal µ-calculus) to specify safety properties for Erlang programs. We also define an automated translation from formulas in this sub-logic to concurrent Erlang monitors that detect formula violations at runtime. Subsequently, we formalise a novel definition for monitor correctness that incorporates monitor behaviour when instrumented with the program being monitored. Finally, we devise a sound technique that allows us to prove monitor correctness in stages; this technique is used to prove the correctness of our automated monitor synthesis.

On Synchronous and Asynchronous Monitor Instrumentation for Actor-based systems

“…In [23], the authors present a tool that synthesises concurrent monitors (as systems of Erlang processes) from a syntactic subset of the modal µ-calculus specifying safety properties for Erlang systems; the sublogic is called sHML [3]. In [23], these monitors asynchronously analyse the system so as to verify for runtime violations of the respective formulas. Actor based systems such as those constructed using Erlang typically grown and shrink in size as computation progresses.…”

“…2. The logic is an extension to that of [23], facilitating the expression of properties dealing with data. It is parametrised by a set of boolean expressions, b, c ∈ Bool, equipped with a decidable evaluation function, b ⇓ v where v ∈ {true, false}, and a set of actions α, β ∈ Act that may universally quantify over data values.…”

Runtime Verification for Decentralised and Distributed Systems

“…For example, Berkovich et al [14] propose to use additional hardware (a GPU parallel execution platform) to minimize the impact of online monitors on execution time overhead, reducing the intrusiveness. Moreover, the works by Francalanza and Seychell [59,60] report performance gains in terms of lower overheads when monitors are specified as concurrent entities and executed over the prevalent multi-core and multi-processor architectures. This gain is obtained because the concurrent monitors exploit better the resources of the underlying processing units.…”

“…This line of research is explored extensively by Francalanza and Seychell [59,60] and Attard and Francalanza [3] for both safety and co-safety properties of logics involving conjunctions, disjunctions and recursion. Conjunctions and disjunctions are synthesised into concurrent monitors that analyse sub-parts of the system, whereas recursion leads to the dynamic generation of concurrent monitors, generated lazily only when required to minimize monitoring overheads.…”

“…For example, the works by Falcone et al [49] and by Cassar and Francalanza [23,24], already mentioned, exploit the hierarchical structure of the system to generate local monitors. On the other hand, Cassar et al [25] and Francalanza and Seychell [59,60] exploit the structure and semantics of the correctness property from which the monitors are synthesised to generate monitor organisations that use the underlying hardware efficiently. Concretely, the generated monitors minimize idle computing units and improve memory management via redundant monitor deallocations and monitor network reorganisations.…”