Explainable Online Monitoring of Metric Temporal Logic

Abstract

Runtime monitors analyze system execution traces for policy compliance. Monitors for propositional specification languages, such as metric temporal logic (MTL), produce Boolean verdicts denoting whether the policy is satisfied or violated at a given point in the trace. Given a sufficiently complex policy, it can be difficult for the monitor’s user to understand how the monitor arrived at its verdict. We develop an MTL monitor that outputs verdicts capturing why the policy was satisfied or violated. Our verdicts are proof trees in a sound and complete proof system that we design. We demonstrate that such verdicts can serve as explanations for end users by augmenting our monitor with a graphical interface for the interactive exploration of proof trees. As a second application, our verdicts serve as certificates in a formally verified checker we develop using the Isabelle proof assistant.

Explainable Online Monitoring of Metric First-Order Temporal Logic

“…(In addition, eval keeps track of the variable ordering used in PDTs via the parameter vs.) Lists in the output are necessary because delays may occur for (bounded) future operators and a single time-point might trigger multiple outputs. Our algorithm extends Lima et al's algorithm [25] computing proof trees for MTL. We highlight our key additions to eval and the state Figure 9 in gray.…”

“…Our proof system consists of two mutually dependent judgments, ⊢ + σ and ⊢ − σ (again σ is omitted when clear), that characterize a formula's satisfaction v, i ⊢ + σ α and violation v, i ⊢ − σ α relations for assignment v, stream σ, and time-point i. The rules of our proof system closely follow the MFOTL semantics (Figure 1) and extend the proof system used by Lima et al [25] with assignments (that are mostly passed around without modification) and the rules for quantifiers (which modify the assignments). The rules for atomic predicates and Boolean constants and operators are self-explanatory: e.g., predicates are satisfied if a matching event is present in the trace; a conjunction is satisfied if both conjuncts are satisfied; a conjunction is violated if either of the conjuncts is violated.…”

“…Lima et al [25] propose the use of richer verdicts in an MTL monitor. Specifically, they use proof trees in a dedicated proof system resembling MTL's semantics to explain why a formula is satisfied or violated.…”

“…We thus have arrived at our notion of explainable verdicts for MFOTL formulas: PDTs whose leaves are proof objects. We extend our verified checker from proof objects to such verdicts and Lima et al's algorithm for MTL [25] to MFOTL (Section 5). Our algorithm extension is modular in the sense that it merely adds a layer of PDTs, but keeps Lima et al's algorithms for temporal operators unchanged.…”

“…Further Related Work Lima et al's work [25], which we extend, is based on the work by Basin et al [9] that employed proof trees as explanations in the context of understanding counterexamples of LTL model checkers. We refer to these works for a discussion of related proof systems for propositional temporal logics and regular expressions.…”