We introduce a formal notation for the processing of event traces called Stream Logic (SL). A monitor evaluates a Boolean condition over an input trace, while a filter outputs events from an input trace depending on some monitor's verdict; both constructs can be freely composed. We show how all operators of Linear Temporal Logic, as well as the parametric slicing of an input trace, can be written as Stream Logic constructs.

1. Runtime Monitoring of
Stream Logic Formulæ
Sylvain Hallé and Raphaël Khoury
Fonds de recherche
sur la nature
et les technologies
CRSNG
NSERC
Université du Québec à Chicoutimi, Canada

3. System

4. System

5. System
Instrumentation

6. System
Instrumentation

7. System
Instrumentation
Trace

8. System
Instrumentation
Trace
Events

9. System
Instrumentation
Trace
Events

10. System
Instrumentation
Trace
Events
Trace
validation

11. Iterator<T>

12. Iterator<T>
hasNext
next

13. Iterator<T>
hasNext
next
A call to next must be preceded
by a call to hasNext

14. B
A

15. B
A
No CartCreate request can occur
before a LoginResponse message

16. Login

17. Login
Three successive login attempts
should trigger an alarm

19. Receive order

20. Receive order
Ready?

21. Receive order
Ready? Yes

22. Receive order
Ready? Yes
File order
No Ship

23. Receive order
Ready? Yes
File order
No Ship
A received order must eventually
be shipped

24. A
0 1 2 3 4 . . .
a a b c b
ℕ
A trace m is a mapping from ℕ to
the set of events :
ALet be a set of event symbols.

25. A monitor takes as input an event trace and outputs
a trace of truth values
a c d T
T T
. . .
T
T
c
T T T . . .
T T T
. . .
. . .
T T
T

26. Notation:
m : φ
Input trace Expression

27. The output of monitors can be combined using
the usual logical connectives
φ ∧ ψ
T
T
. . .φ
∧
ψ T
T
. . .

28. Inputs and outputs may be delayed: the notation
induces an implicit buffering
T T . . .φ
∧
ψ T . . .
Processing advances in discrete steps: an event is
either produced or not at step n
=> delays != processing time
T
1 2
T
T
3
1 2 3
T

29. A filter takes as input an event trace and a monitor.
It outputs event n if and only if the n-th output of its
monitor is true.
. . .
φ
∞
∞
φa c d a d

30. Notation:
∞
φ
k
φ
Output all events
(satisfying φ)
Output only the k-th
event satisfying φ

31. ∞
c ∨ d
Output all events that satisfy c or d
∞
c
1 : T
Output the first event that satisfies c
c2 :
T
1
))b ∧
: T
Monitor "some b is
immediately followed
by a c"

32. Linear Temporal Logic can be recursively
mapped into filters and monitors
μ(φ)
1
: Tμ(F φ) =
μ(X φ) = μ(φ)
2
:
T
μ(φ U ψ) = μ(¬φ)
1
:
T
μ(ψ)
1
: T∧1
G φ F ψwhichever
comes first

33. A call to next must be followed by a call
to hasNext
No CartCreate request can occur
before a LoginResponse message
A received order must eventually
be shipped
Three successive login attempts should
trigger an alarm
G (next → X hasNext)
¬ CartCreate U hasNext
G (receive → F ship)
G ¬(fail ∧ (X (fail ∧ X fail)))

34. A few identities can be applied...
1
:
T
1
:
T
p
1
:
T
T
ϵ :
T
ϵ

35. A few identities can be applied...
1
:
T
1
:
T
p
1
:
T
T
ϵ :
T
ϵ

36. A few identities can be applied...
1
:
T
1
:
T
p
1
:
T
T
ϵ :
T
ϵ

37. A few identities can be applied...
1
:
T
1
:
T
p
1
:
T
T
ϵ :
T
ϵ

38. A few identities can be applied...
1
:
T
1
:
T
p
1
:
T
T
ϵ :
T
ϵ
μ(G F p) =
= the empty trace

39. * 10
100
0
>
0
>
0
10
peeB peeB 3http://lif-labs.github.io/beepbeep-3
Principle further generalized and
implemented in...