Specification and Efficient Monitoring Beyond STL
 1 Citations
 4.2k Downloads
Abstract
An appealing feature of Signal Temporal Logic (STL) is the existence of efficient monitoring algorithms both for Boolean and realvalued robustness semantics, which are based on computing an aggregate function (conjunction, disjunction, min, or max) over a sliding window. On the other hand, there are properties that can be monitored with the same algorithms, but that cannot be directly expressed in STL due to syntactic restrictions. In this paper, we define a new specification language that extends STL with the ability to produce and manipulate realvalued output signals and with a new form of until operator. The new language still admits efficient offline monitoring, but also allows to express some properties that in the past motivated researchers to extend STL with existential quantification, freeze quantification, and other features that increase the complexity of monitoring.
1 Introduction
Signal Temporal Logic (STL [16, 17]) is a temporal logic designed to specify properties of realvalued densetime signals. It gained popularity due to the rigour and the ability to reason about analog and mixed signals; and it found use in such domains as analog circuits, systems biology, cyberphysical control systems (see [3] for a survey). A major use of STL is in monitoring: given a signal and an STL formula, an automated procedure can decide whether the formula holds at a given time point.
Monitoring of STL is reliably efficient. A monitoring procedure typically traverses the formula bottom up, and for every subformula computes a satisfaction signal, based on satisfaction signals of its operands. Boolean monitoring is based on the computation of conjunctions and disjunctions over a sliding window (“until” is implemented using a specialized version of running conjunction), and robustness monitoring (computing how well a signal satisfies a formula [9, 10]) is based on the computation of minimum and maximum over a sliding window. The complexity of both Boolean and robustness monitoring is linear in the length of the signal and does not depend on the width of temporal windows appearing in the formula. At the same time, for a range of applications, pure STL is either not expressive enough or difficult to use, and specifying a desired property often becomes a puzzle of its own. The existence of robustness and other realvalued semantics does not always help, since a monitor can perform a limited set of operations that the semantics assigns to Boolean operators. For example, for robustness semantics, \(\min \) and \(\max \) are the only operations beyond the atomic proposition level.
One way to work around the expressiveness issues of STL is preprocessing: a computation that cannot be performed by an STL monitor can be performed by a preprocessor and supplied as an extra input signal. For a number of reasons, this is not always satisfactory. First, for monitoring of continuoustime signals, there is a big gap between the logical definitions of properties and the implementation of monitors. In continuoustime setting, properties are defined using quantification, upper and lower bounds, and similar mathematical tools for dense sets, while a monitor works with a finite piecewise representation of a signal and performs a computation that is based on induction and other tools for discrete sets. Leaving this gap exposed to the user, who has to implement the preprocessing step, is not very userfriendly. Second, monitoring of some properties cannot be cleanly decomposed into a preprocessing step followed by standard STL monitoring. Later, we give a concrete example using an extended “until” operator, and for now, notice that “until” instructs the monitor to compute a conjunction over the window that is not fixed in advance, but is defined by its second operand. Because of that, multiple researches have been motivated to search for a more expressive superset of STL that would allow to specify the properties they were interested in.
One direction for extension is to add to the original quantifierfree logic (MTL, STL) a form of variable binding: a freeze quantifier as in STL* [6], a clock reset as in TPTL [1], or even first order quantification [2]. Unfortunately, such extensions are detrimental to complexity of monitoring. When monitoring logics with quantifiers using standard bottomup approach, subformulas containing free variables evaluate not to Boolean or realvalued signals, but to maps from time to nonconvex sets, and they cannot in general be efficiently manipulated (although for some classes of formulas monitoring of logics with quantifiers works well [4, 13]). Perhaps the most benign in this respect but also least expressive extension is 1TPTL (TPTL with one active clock), which is as expressive as MITL, but is easier to use and admits a reasonably efficient monitoring procedure [11].
An alternative direction is to define a quantifierfree specification language with more flexible syntax and sliding window operations. For example, Signal Convolution Logic (SCL [20]) allows to specify properties using convolution with a set of select kernels. In particular, it can express properties of the form “statement \(\varphi \) holds on an interval for at least X% of the time”. In SCL, every formula has a Boolean satisfaction signal, but some works go further and allow a formula to produce a realvalued output signal based on the realvalued signals of its subformulas. This already happens for robustness of STL in a very limited way, and can be extended. For example, [19] presents temporal logic monitoring as filtering, which allows to derive multiple different realvalued semantics. Another work [7] focuses on the practical application of robustness in falsification and allows to choose between different possible robust semantics for “eventually” and “always”, in particular to replace \(\min \) or \(\max \) with integration where necessary.
This paper is our take on extending STL in the latter direction. We define a specification language that is more expressive than STL, but not less efficient to monitor offline, i.e., the complexity of monitoring is linear in the length of the signal and does not depend on the width of temporal windows in the formula (the latter property tends to be missing from the STL extensions, even when the authors can achieve linear complexity for a fixed formula). The most important features of the new language are as follows.
 1.
We remove several syntactic constrains from STL: we allow a formula to have a realvalued output signal; we allow these signals to be combined in a pointwise way with arithmetic operations, comparisons, etc. This distinguishes us from the works that use standard MTL or STL syntax and assign them new semantics [10, 19].
 2.
We allow to apply an efficiently computable aggregate function over a sliding window. We currently focus on \(\min \) and \(\max \), which are enough to specify properties that motivated the development of more expressive and hard to monitor logics.
 3.
We offer a version of “until” operator that performs aggregation over a sliding window of dynamic width, that depends on satisfaction of some formula. This distinguishes us from the works that focus on aggregation over a fixed window [20].
Finally, we focus our attention on continuoustime piecewiseconstant and piecewise linear signals; we describe the algorithms and prepare an implementation only for piecewiseconstant.
2 Motivating Examples
Before formally defining the new language, let us look at some examples of properties that we would like to express. In particular, we look at properties that motivated the development of more expressive and harder to monitor logics.
Example 1
Example 2
(Local Maximum). Consider the property: “the current value of x is a minimum or maximum in some neighbourhood of current time point”. Previously, a similar property became a motivation to extend STL with freeze quantifiers [6], but we can also express it by comparing the value of a signal with some aggregate information about its neighbourhood, which we can do similarly to the previous example.
Example 3
(Stabilization Contd.). We want to be able to assert that x becomes stable around some value not for a fixed duration, but until some signal q becomes true. We will be able to do this with our version of “until” operator.
Example 4
(Linear Increase). At this point, we can assert x to follow a more complex shape, for example, to increase or decrease with a given slope. Let T denote an auxiliary signal that linearly increases with rate 1 (like a clock of a timed automaton), i.e. we define \(T(t)=t\); this example works as well for \(T(t) = t + c\), where c is a constant. To specify that x increases with the rate 2.5, we assert that the distance from x to \(2.5\cdot \mathrm {T}\) stays within some bounds.
3 Syntax and Semantics
From the examples above we can foresee how the new language looks like. Formally, an (input) signal is a function \(w:\mathbb {T}\rightarrow \mathbb {R}^n\), where the time domain \(\mathbb {T}\) is a closed real interval \([0, w] \subseteq \mathbb {R}\), and the number w is the duration of the signal. We refer to signal components using their own letters: \(x, y, \dots \in \mathbb {T}\rightarrow \mathbb {R}\). We assume that every signal component is piecewiseconstant or piecewiselinear.
The semantics of a formula is a piecewiseconstant or piecewiselinear function from real time (thus, has realvalued switching points) to a dual number (rather than a real). We defer the discussion of dual numbers until Sect. 3.2; for now we note that they extend reals, and a dual number can be written in the form \(a + b\varepsilon \), which, when \(b \ne 0\), denotes a point infinitely close to a. We denote the set of dual numbers as \(\mathbb {R}_{\varepsilon }\). Our primary use of a dual number is to represent a time point strictly after an event (switching point, threshold crossing, etc.) but before any other event can happen; as a result we have to allow an output signal to have a dual value, denoting a value that is attained at this dual time point.
Pointwise Functions. Function symbol f ranges over realvalued functions \(\mathbb {R}^n\rightarrow \mathbb {R}\) that preserve the chosen shape of signals (and can be lifted to dual numbers). In this paper, we focus on piecewiseconstant and piecewiselinear signals, so when f is applied pointwise to a piecewiseconstant input, we want the result to be piecewiseconstant; when f is applied pointwise to a piecewiselinear input, we want the result to be piecewiselinear. Examples of such functions are addition, subtraction, \(\min \) and \(\max \) of finitely many operands (we use lowercase \(\min \) and \(\max \) to denote a realvalued nary function), multiplication by a constant, absolute value, etc.
 1.
refer to an input signal x;
 2.
apply a realvalued function f pointwise to the outputs its \(\varphi \)subformulas;
 3.
apply an aggregate function over the sliding window [a, b] (with some abuse of notation a can be \(\infty \), and b can be \(\infty \));
 4.
be an “until” formula, which is described in Sect. 3.3.
3.1 Semantics of UntilFree Fragment
3.2 Dual Numbers
Dual numbers extend reals with a new element \(\varepsilon \) that has a property \(\varepsilon ^2=0\). A dual number can be written in a form \(a + b\varepsilon \), where \(a, b \in \mathbb {R}\). We denote the set of dual numbers as \(\mathbb {R}_{\varepsilon }\). Dual numbers were proposed by the English mathematician W. Clifford in 1873 and later applied in geometry by the German mathematician E. Study. One of modern applications of dual numbers and their extensions is in automatic differentiation [12]: one can exactly compute the value of the first derivative at a given point using the identity \(f(x+\varepsilon ) = f(x) + f'(x)\varepsilon \). Intuitively, \(\varepsilon \) can be understood as an infinitesimal value, and \(a + b\varepsilon \) (for \(b\ne 0\)) is a point that is infinitely close to a. Polynomial functions can be extended to dual numbers, and via Taylor expansion, so can exponents, logarithms, and trigonometric functions. We work with piecewiseconstant and piecewiselinear functions with real switching points, and we only make use of basic arithmetic. For example, if on the interval \((b_1, b_2)\) the signal x is defined as \(x(t) = a_1 t + a_0\), then \(x(b_1 + \varepsilon ) = a_1 b_1 + a_0 + a_1 \varepsilon \) and \(x(b_2  \varepsilon ) = a_1 b_2 + a_0  a_1 \varepsilon \).
Our primary use of a dual number is to represent a time point strictly after an event (a switching point, a threshold crossing, etc.) but before any other event can happen, i.e., we use \(t' + \varepsilon \) to represent the time point that happens right after \(t'\). The coefficient 1 at \(\varepsilon \) denotes that time advances with the rate of 1 (although another consistently used coefficient works as well). Consequently, we also allow an output signal to produce a dual value, denoting a value that is attained at this dual time point. On the other hand, we require that signals are defined over real time, switching points of piecewise signals are reals, and time constants in formulas are reals. That is, dualvalued time is only used internally by the temporal operators and cannot be directly observed.
Example 5
Consider the signal x defined as: “\(x(t) = 0.5t + 1.5 \text { if } t \in [0, 1); x(t) = 0.5t + 1 \text { if } t \ge 1\)”, as shown in Fig. 4. Let us find the minimum of x on the interval \([0,2+\varepsilon ]\). By our definition, \(\min _{t\in [0,2+\varepsilon ]} x(t) = \min \{ x(0), x(1\varepsilon ), x(1), x(2+\varepsilon ) \} = x(1\varepsilon ) = 1+0.5\varepsilon \). This result should be understood as follows: x(t) approaches the value of 1 from the above with derivative \(0.5\), but never reaches it.
Example 6
Our definition of minimum and maximum allows to correctly compare values of piecewiselinear functions around their discontinuity points. In Example 5, x never reaches the value of its lower bound, and our definition of minimum produces a dual number that reflects this fact and also specifies the rate at which x approaches its lower bound. This information would be lost if we computed the infimum of x. Again consider the signals in Fig. 4, with x defined as before, and “\(y(t) = t, \text { if } t \in [0,1), y(t) = 0.5t+1, \text { if } t \ge 1\)”. Let us evaluate at time \(t=0\) the formula \(\mathop {\mathrm {On}_{[0,2]}} \mathop {\mathrm {Min}}x > \mathop {\mathrm {On}_{[0,2]}} \mathop {\mathrm {Max}}y\), which denotes the property \(\forall t,t'\in [0,2].\ x(t) > y(t')\). From the previous example, we have that Open image in new window . By a similar argument, Open image in new window , which means that y approaches 1 from below with the rate of 1. Since, \(1+0.5\varepsilon > 1\varepsilon \), our property holds at time 0, as expected.
We want to emphasize that while an output signal can take a dual value, its domain is considered to be a subset of reals. The semantics of temporal operators are allowed to internally use dualvalued time points, but has to produce an output signal that is defined over real time. This ensures that a piecewise signal always has realvalued switching points and that no event can happen at a dualvalued time point.
Example 7
3.3 Semantics of Until
The \(\mathrm {On}\)operator allowed us to compute minima and maxima over a sliding window of fixed width. In this section, we introduce a new version of “until” operator that allows the window to have variable width that depends on the output signal of some formula.
 1.
Figure 5: q is false for every \(t' \ge t\). Then the value of \(p \mathbin {\mathrm {U}_{}^\mathrm{STL}} q\) at t is false.
 2.
Figure 6: there exists the smallest \(t' \ge t\), where q is true (this includes the case, where \(t' = t\)). Then the value of \(p \mathbin {\mathrm {U}_{}^\mathrm{STL}} q\) at t is \(\forall s \in [t,t'].\ p(s)\) (predicate p is not shown in the figure). The monitor needs not consider time points after \(t'\), since if “forall” produces false on a smaller interval, it will produce false on a larger one.
 3.
Figure 7: q becomes true in the future, but there is no earliest time point. In this case, the monitor needs to take the universal quantification over an interval that ends just after \(t'\) (the switching point of q), but before any other event occurs. We can formalize this reasoning using dual numbers and say that the value of \(p \mathbin {\mathrm {U}_{}^\mathrm{STL}} q\) at t is \(\forall s \in [t,t'+\varepsilon ].\ p(s)\), where \(t'+\varepsilon \) can be intuitively understood as a time point that happens after \(t'\), but before any other event can occur.
Example 8
Let us consider two linear input signals: \(x(t) = t\) and \(y(t) = 2t1\) (see Fig. 3), and let us evaluate the formula \((y \le x) \mathbin {\mathrm {U}_{}^\mathrm{STL}} (x > 1)\) at time 0 using nonstrict “until” semantics. We define the earliest time point where \(x > 1\) becomes true to be \(1 + \varepsilon \), thus we need to evaluate the expression \(\forall t \in [0,1+\varepsilon ].\ y(t) \le x(t)\). At time \(1+\varepsilon \), we get \(y(1+\varepsilon ) = 1+2\varepsilon > 1+\varepsilon = x(1+\varepsilon )\), thus the “until” formula does not hold. Informally, we can interpret the result as follows: when x becomes greater than 1, y becomes greater than x, while nonstrict “until” requires that there exists a point, where both its left and righthand operands hold at the same time.
Example 9
Example 10
Example 11
(TPTLlike Assertion). The second form of “until” allows to reason explicitly about time points and durations, somewhat similarly to TPTL. Consider the property “within 2 time units, we should observe an event p followed by an event q” (Fig. 8 shows an example of a satisfying signal). With some case analysis, this property can be expressed in MTL [5], but probably the best way to express it is offered by TPTL, that allows to assert “\(c. \mathop {\mathrm {F}_{}} (p \wedge \mathop {\mathrm {F}_{}} (q \wedge c \le 2))\)”, meaning “reset a clock c, eventually, we should observe p and from that point, eventually we should observe q, while the clock value will be at most 2”. To express the property in our language, we introduce three auxiliary signals: \(T(t) = t\) (which we use in some other examples as well), \( pdelay = (T\!\downarrow \mathbin {\mathrm {U}_{}^{\infty }} p)  T\), which denotes the duration until the next occurrence of p and similarly \( qdelay = (T\!\downarrow \mathbin {\mathrm {U}_{}^{\infty }} q)  T\), the duration until the next occurrence of q. Then, the property can be expressed as: \( pdelay + ( qdelay \!\downarrow \mathbin {\mathrm {U}_{}^{\infty }} p) \le 2 \).
4 Monitoring
Similarly to other works on STL monitoring (e.g., [9]), we implement the algorithms for a subset of the language, and support the remaining operators via rewriting rules.
All operators in the language of the monitor admit efficient offline monitoring. Minimum and maximum over a sliding window required by the \(\mathop {\mathrm {On}_{}}\)operator can be computed using a variation of Lemire’s algorithm [9, 15]; “lookup” operator \(\mathrm {D}\) shifts its input signal by a constant distance; and for untimed “until” we can scan the input signal backwards and perform a special case of running minimum or maximum.
4.1 Monitoring Algorithms
In this section, we briefly describe monitoring algorithms for piecewiseconstant signals.
Representation of Signals. We represent a piecewiseconstant function \(\mathbb {T}\rightarrow \mathbb {R}\) or \(\mathbb {T}\rightarrow \mathbb {R}_{\varepsilon }\) as a sequence of segments: \(\langle s_0, s_1, \dots , s_{m1} \rangle \), where every segment \(s_i = J_i \mapsto v_i\) maps an interval \(J_i\) to a real or dual value \(v_i\). The intervals \(J_i\) form a partition the domain of the signal and are ordered in ascending time order, i.e., \(\sup J_i = \inf J_{i+1}\) and \(J_i \cap J_{i+1} = \varnothing \). The domain of the signal corresponding to the sequence \(u = \langle J_0\mapsto v_o,\dots , J_{m1}\mapsto v_{m1} \rangle \) is denoted by \( dom (u) = J_0 \cup \dots \cup J_{m1}\). For example, if the function x(t) is defined as \(x(t) = 0\), if \(t \in [0, 1)\), and \(x(t) = 1\), if \(t \in [1, 2]\), then x(t) is represented by the sequence \(u_x = \langle [0, 1) \mapsto 0, [1, 2] \mapsto 1 \rangle \), and \( dom (u_x) = [0, 2]\).
Empty brackets \(\langle \rangle \) denote an empty sequence that does not represent a valid signal, but can be used by algorithms as an intermediate value. We manipulate the sequences with two main operations. The function \( append \) adds a segment to the end of a sequence: \( append (\langle s_0,\dots ,s_{m1} \rangle ,s') = \langle s_0,\dots ,s_{m1}, s' \rangle \). The function \( prepend \) adds a segment to the start of a sequence: \( prepend (\langle s_0,\dots ,s_{m1} \rangle ,s') = \langle s', s_0,\dots ,s_{m1} \rangle \). This may produce a sequence where the first segment does not start time at time 0. While such a sequence does not represent a valid signal, it can be used by the algorithms as an intermediate value. The function \( removeLast \) removes the last segment of a sequence, assuming it was nonempty: \( removeLast (\langle s_0,\dots ,s_{m1} \rangle ) = \langle s_0,\dots ,s_{m2} \rangle \).
An output signal of a formula is scalarvalued and is represented by one such sequence. An input signal usually has multiple components, i.e., it is a function \(\mathbb {T}\rightarrow \mathbb {R}^n\), and is represented by a set of n sequences.
OnFormulas. For \(\mathop {\mathrm {On}_{[a,b]}} \mathop {\mathrm {Min}}\varphi \) and \(\mathop {\mathrm {On}_{[a,b]}}\mathop {\mathrm {Max}}\varphi \), a monitor needs to compute the minimum or maximum of the output signal of \(\varphi \) over the sliding window. The corresponding algorithm was developed for discrete time by Lemire [15] and later adapted for continuous time [9].
UntilFormulas. Informally, monitoring the “until”formulas, \(\mathop {\mathrm {Min}}\varphi _1 \mathbin {\mathrm {U}_{}^{d}} \varphi _2\), \(\mathop {\mathrm {Max}}\varphi _1 \mathbin {\mathrm {U}_{}^{d}} \varphi _2\), and \(\varphi _1\!\downarrow \mathbin {\mathrm {U}_{}^{d}} \varphi _2\), works as follows. The monitor scans the output signals of \(\varphi _1\) and \(\varphi _2\) backwards. While \(\varphi _2\) evaluates to a nonzero value, the monitor outputs the value of \(\varphi _1\). When \(\varphi _2\) evaluates to 0, the monitor outputs either the default value (if the monitor did not yet encounter a nonzero value of \(\varphi _2\)), or the running minimum or maximum of \(\varphi _1\), or the value that \(\varphi _1\) had at the last time point where \(\varphi _2\) was nonzero.
The function \( until \) and \( untilAnd \) in Fig. 10 implement this idea. The inputs to the function \( until \) are: sequences \(u_1\) and \(u_2\) representing the output signals of \(\varphi _1\) and \(\varphi _2\) (with \( dom (u_1) = dom (u_2)\)), default value d, and the function f used for aggregation; it can be \(\min \), \(\max \), or the special function \(\lambda x,y.\ x\) which returns the value of its first argument and which we use to monitor the formula \(\varphi _1\!\downarrow \mathbin {\mathrm {U}_{}^{d}} \varphi _2\). The function \( until \) scans the input sequences backwards and iterates over intervals where both input signals maintain a constant value (J). Each such interval is passed to the function \( untilAdd \), which updates the state of the algorithm (\(v'\), s) and constructs the output signal (\(u_r\)).
5 Implementation and Experiments
We implemented the monitoring algorithm in a prototype tool that is available at https://gitlab.com/abakhirkin/StlEval. The tool has a number of limitations, notably it can only use piecewiseconstant interpolation (so we cannot evaluate examples that use the auxiliary signal \(T(t) = t\)) and does not support pasttime operators. It is written in C++ and uses doubleprecision floating point numbers for time points and signal values. We evaluate the tool using a number of synthetic signals and a number of properties based on the ones described earlier in the paper.
Signals. We use the following signals discretized with time step 1.

\(x_\mathrm{sin}\) – sine wave with amplitude 1 and period 250; see red curve in Fig. 2.

\(x_\mathrm{decay}\) – damped oscillation with period 250. For \(t \in [0,1000)\), x defined as \( x_\mathrm{decay}(t) = \frac{1}{e}\sin (250t + 250)e^{\frac{1}{250}x} \), see red curve in Fig. 1; for \(t \ge 1000\), the pattern repeats;

\(x_\mathrm{spike}\) – series of spikes; a single spike is defined for \(t \in [0,125)\) as: \( x_\mathrm{spike}(t) = e^{\frac{(t50)^2}{2\cdot 10^2}} \), and after that the pattern repeats; see blue curve in Fig. 9.

\(\varphi _\mathrm{stab} = \mathop {\mathrm {G}_{}} \mathop {\mathrm {F}_{}} \big (\mathop {\mathrm {On}_{[0,200]}} \mathop {\mathrm {Max}}x  \mathop {\mathrm {On}_{[0,200]}} \mathop {\mathrm {Min}}x \le 0.1\big )\), x always eventually becomes stable around some value for 200 time units.

\(\varphi _\mathrm{stab0} = \mathop {\mathrm {G}_{}} \mathop {\mathrm {F}_{}} \mathop {\mathrm {G}_{[0,200]}} (x \le 0.05)\): x always eventually becomes stable around 0 for 200 time units.

\(\varphi _\mathrm{until} = \mathop {\mathrm {G}_{[0,20k]}} \mathop {\mathrm {F}_{}} \big ((\mathop {\mathrm {Max}}x) \mathbin {\mathrm {U}_{[200,\infty )}^{\infty }} (x' \ge 0.1)\big )  \big ((\mathop {\mathrm {Min}}x) \mathbin {\mathrm {U}_{[200,\infty )}^{\infty }} (x' \ge 0.1)\big ) \le 0.1\), where \(x' = (\mathop {\mathrm {D}_{1}^{0}} x  x)\), x always eventually becomes stable for at least 200 time units and then starts changing with derivative of at least 0.1.

\(\varphi _\mathrm{maxmin} = \mathop {\mathrm {G}_{}} \big ((x \ge \mathop {\mathrm {On}_{[0,85]}} \mathop {\mathrm {Max}}x) \mathbin {\Rightarrow }\mathop {\mathrm {F}_{}} (x \le \mathop {\mathrm {On}_{[0,85]}} \mathop {\mathrm {Min}}x)\big )\), every local maximum is followed by a local minimum.

\(\varphi _\mathrm{abovebelow} = \mathop {\mathrm {G}_{}} \big (x \ge 0.85 \mathbin {\Rightarrow }(\mathop {\mathrm {F}_{}} x \le 0.85)\big )\), if x is above 0.85, it should eventually become below \(0.85\).

\(\varphi _\mathrm{spike} = (\mathop {\mathrm {On}_{[0,16]}} \mathop {\mathrm {Max}}x \ge x + 0.5) \wedge \mathop {\mathrm {F}_{[0,16]}}(\mathop {\mathrm {On}_{[0,16]}} \mathop {\mathrm {Min}}x \le x  0.5)\), spike of halfwidth 16 and height at least 0.5.

\(\varphi _\mathrm{spikestlib} = \mathop {\mathrm {F}_{}} \big (x' \ge 0.04 \wedge \mathop {\mathrm {F}_{[0,25]}} (x' \le 0.04)\big )\), where \(x' = (\mathop {\mathrm {D}_{1}^{0}} x  x)\), spike of width at most 25 and magnitude 0.04.
Some properties are expressed in our language using \(\mathrm {On}\) and “until”operators, and some are STL properties. This allows us to see how much time it takes to monitor a more complicated property in our language (e.g., \(\varphi _\mathrm{stab}\), stabilization around an unknown value) compared to a similar but more simple STL property (e.g., \(\varphi _\mathrm{stab0}\), stabilization around a known value). In our experiments we see a constant factor between 2 and 5.
Monitoring time for different formulas and signals.
6 Conclusion and Future Work
We describe a new specification language that extends STL with the ability to produce and manipulate realvalued output signals (while in STL, every formula has a Boolean output signal). Properties in the new language are specified in terms of minima and maxima over a sliding window, which can have fixed width, when using a generalization of \(\mathrm {F}\) and \(\mathrm {G}\)operators, or variable width, when using a new version “until”. We show how the new language can express properties that motivated the creation of more expressive and harder to monitor logics. Offline monitoring for the new language is almost as efficient as STL monitoring; the complexity is linear in the length of the input signal and does not depend on the constants appearing in the formula.
There are multiple directions for future work; perhaps more interesting one is adding integration over a sliding window (in addition to minimum and maximum). This is already allowed by some formalisms [7], and when added to our language will allow to assert that a signal approximates the behaviour of a system defined by a given differential equation (since we will be able to assert \(y(t) \approx \int _0^t x(t)dt\)). Before making integration available, we wish to investigate how to better deal in a specification language with approximation errors. Finally, we wish to make our language usable in falsification, which means that for every formula with Boolean output signal we wish to be able to compute a realvalued robustness measure.
Notes
Acknowledgements
The authors thank T. Ferrére, D. Nickovic, E. Asarin for comments on the draft of this paper, and O. Lebeltel for providing a version of AMT for the experiments.
References
 1.Alur, R., Henzinger, T.A.: A really temporal logic. J. ACM 41(1), 181–204 (1994)MathSciNetCrossRefGoogle Scholar
 2.Bakhirkin, A., Ferrère, T., Henzinger, T.A., Nickovic, D.: The firstorder logic of signals: keynote. In: Brandenburg, B.B., Sankaranarayanan, S. (eds.) International Conference on Embedded Software (EMSOFT), pp. 1:1–1:10. ACM (2018)Google Scholar
 3.Bartocci, E., et al.: Specificationbased monitoring of cyberphysical systems: a survey on theory, tools and applications. In: Bartocci, E., Falcone, Y. (eds.) Lectures on Runtime Verification. LNCS, vol. 10457, pp. 135–175. Springer, Cham (2018). https://doi.org/10.1007/9783319756325_5CrossRefGoogle Scholar
 4.Basin, D.A., Klaedtke, F., Müller, S., Zalinescu, E.: Monitoring metric firstorder temporal properties. J. ACM 62(2), 15:1–15:45 (2015)MathSciNetCrossRefGoogle Scholar
 5.Bouyer, P., Chevalier, F., Markey, N.: On the expressiveness of TPTL and MTL. Inf. Comput. 208(2), 97–116 (2010)MathSciNetCrossRefGoogle Scholar
 6.Brim, L., Dluhos, P., Safránek, D., Vejpustek, T.: STL*: extending signal temporal logic with signalvalue freezing operator. Inf. Comput. 236, 52–67 (2014)MathSciNetCrossRefGoogle Scholar
 7.Claessen, K., Smallbone, N., Eddeland, J., Ramezani, Z., Akesson, K.: Using valued Booleans to find simpler counterexamples in random testing of cyberphysical systems. In: Workshop on Discrete Event Systems (WODES) (2018)Google Scholar
 8.Donzé, A.: Breach, a toolbox for verification and parameter synthesis of hybrid systems. In: Touili, T., Cook, B., Jackson, P. (eds.) CAV 2010. LNCS, vol. 6174, pp. 167–170. Springer, Heidelberg (2010). https://doi.org/10.1007/9783642142956_17CrossRefGoogle Scholar
 9.Donzé, A., Ferrère, T., Maler, O.: Efficient robust monitoring for STL. In: Sharygina, N., Veith, H. (eds.) CAV 2013. LNCS, vol. 8044, pp. 264–279. Springer, Heidelberg (2013). https://doi.org/10.1007/9783642397998_19CrossRefGoogle Scholar
 10.Donzé, A., Maler, O.: Robust satisfaction of temporal logic over realvalued signals. In: Chatterjee, K., Henzinger, T.A. (eds.) FORMATS 2010. LNCS, vol. 6246, pp. 92–106. Springer, Heidelberg (2010). https://doi.org/10.1007/9783642152979_9CrossRefzbMATHGoogle Scholar
 11.Elgyütt, A., Ferrère, T., Henzinger, T.A.: Monitoring temporal logic with clock variables. In: Jansen, D.N., Prabhakar, P. (eds.) FORMATS 2018. LNCS, vol. 11022, pp. 53–70. Springer, Cham (2018). https://doi.org/10.1007/9783030001513_4CrossRefGoogle Scholar
 12.Fike, J.A., Alonso, J.J.: Automatic differentiation through the use of hyperdual numbers for second derivatives. In: Forth, S., Hovland, P., Phipps, E., Utke, J., Walther, A. (eds.) Recent Advances in Algorithmic Differentiation, vol. 87, pp. 163–173. Springer, Heidelberg (2012). https://doi.org/10.1007/9783642300233_15CrossRefzbMATHGoogle Scholar
 13.Havelund, K., Peled, D.: Efficient runtime verification of firstorder temporal properties. In: Gallardo, M.M., Merino, P. (eds.) SPIN 2018. LNCS, vol. 10869, pp. 26–47. Springer, Cham (2018). https://doi.org/10.1007/9783319941110_2CrossRefGoogle Scholar
 14.Kapinski, J., et al.: STLib: a library for specifying and classifying model behaviors. In: SAE Technical Paper. SAE International, April 2016Google Scholar
 15.Lemire, D.: Streaming maximumminimum filter using no more than three comparisons per element. Nordic J. Comput. 13(4), 328–339 (2006)MathSciNetzbMATHGoogle Scholar
 16.Maler, O., Nickovic, D.: Monitoring temporal properties of continuous signals. In: Lakhnech, Y., Yovine, S. (eds.) FORMATS/FTRTFT 2004. LNCS, vol. 3253, pp. 152–166. Springer, Heidelberg (2004). https://doi.org/10.1007/9783540302063_12CrossRefzbMATHGoogle Scholar
 17.Nickovic, D.: Checking timed and hybrid properties: theory and applications. (Vérification de propriétés temporisées et hybrides: théorie et applications). Ph.D. thesis, Joseph Fourier University, Grenoble, France (2008)Google Scholar
 18.Nickovic, D., Lebeltel, O., Maler, O., Ferrère, T., Ulus, D.: AMT 2.0: qualitative and quantitative trace analysis with extended signal temporal logic. In: Beyer, D., Huisman, M. (eds.) TACAS 2018. LNCS, vol. 10806, pp. 303–319. Springer, Heidelberg (2018). https://doi.org/10.1007/9783319899633_18CrossRefGoogle Scholar
 19.Rodionova, A., Bartocci, E., Nickovic, D., Grosu, R.: Temporal logic as filtering. In: Dependable Software Systems Engineering, pp. 164–185 (2017)Google Scholar
 20.Silvetti, S., Nenzi, L., Bartocci, E., Bortolussi, L.: Signal convolution logic. In: Lahiri, S.K., Wang, C. (eds.) ATVA 2018. LNCS, vol. 11138, pp. 267–283. Springer, Cham (2018). https://doi.org/10.1007/9783030010904_16CrossRefGoogle Scholar
Copyright information
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.