Anticipatory Recurrent Monitoring with Uncertainty and Assumptions ⋆

,


Introduction
Runtime verification (RV) is a lightweight dynamic verification technique that focuses on analyzing an actual execution of a system to check correctness properties, which has been studied both in theory and applications [18,1].A common specification language for RV is Linear-time Temporal Logic (LTL) [22] which was originally introduced for infinite runs.However, in RV one necessarily deals with the finite executions, and, as such, adaptions to the original semantics have been considered.A variety of those have been proposed in the literature including infinite extensions of the finite prefix seen so far [2], limiting the logic to use only the next-operator [16], or finite version of LTL [20], strong and weak versions of LTL [9] or the so-called mission time LTL [23].However these monitoring approaches all attempt to answer the initial word problem (whether the trace at the initial position satisfies the property) following different maxims.While a two valued semantics on finite words is adequate for completed, terminated executions, ongoing executions may require semantics with multiple verdicts in order to support both the current view and potential future changes when the execution is continuing.Then, for example, impartiality requires a logic to not change the verdict once the verdict true or false is declared, while different assessments of the current observation may be changed once more information is received.Anticipation takes potential look-aheads into account to sharpen the current verdict.A comprehensive comparison of such approaches is given in [4].
The seminal work by Havelund and Rosu [12] considers a different approach of monitoring.Starting from a past fragment of LTL, their monitors produce a fresh verdict about whether the property holds at the current position of the existing trace, thus recurrently answering the word problem with potentially different outcomes.We call this variant the recurrent word problem.While initial approaches try to return the answer for the first position of the run, Havelund's and Rosu's computes the verdict for the current position of the trace.As the current position is changing with every new observation, their approach implicitly restarts monitoring with every new observation.As such, while the semantics is two valued and does not change the verdict of the position in question-and can thus be considered impartial-the verdicts may change from true to false, for example, as the point of interest varies during monitoring.In this paper, we unify these two approaches (recurrent and initial monitoring), separating the monitoring time at which the questions are answered from the time at which the verdict is referring to.
In general, the recurrent word problem for future temporal logic cannot be solved with an amount of memory that is independent of the length of the trace.Consequently, most approaches with future operators are restricted to the initial word problem.Approaches to monitoring based on stream runtime verification (SRV), see for example Lola [8] produce one output stream value at each position.This output value can encode the outcome of an initial word problem or of a recurrent word problem.The common use of SRV is to encode recurrent word monitoring problems for past (or at least bounded future) specifications because the monitor is guaranteed to run with constant memory, independently of the trace length.Modern SRV systems (both synchronous and asynchronous) including RTLola [5], Lola2.0 [10], CoPilot [21], TeSSLa [7] and Striver [11] follow this approach.
In this paper we first generalize recurrent monitoring beyond Past LTL.For example, extending Past LTL with bounded future suggests that different instants in the trace (not necessarily the current instant) could be the point of interest for a given verdict.Anticipation has been solved for LTL 3 (see [3]) so it is natural to ask whether recurrent monitoring can also be enriched with lookaheads to improve the current verdict by producing it ahead of time.We show that recurrent monitoring can indeed be extended to produce an anticipation of the number of instants before the closest violation or satisfaction, which maybe very useful to take preventive actions.
Also in the context of initial monitoring for LTL, monitors are capable to improve the verdict using partial knowledge of the underlying system [17] or, more generally, assumptions [14,6].A second contribution of this paper is to improve recurrent monitoring with assumptions.Finally, we also consider recurrent monitoring in the presence of uncertainties, meaning, that some of the input values are (partially) unknown.We show a solution to recurrent monitoring that provides anticipation, tolerates uncertainties and is capable of exploiting assumptions.

Preliminaries
We use Z for the set of integers, N, N + for the set of natural numbers with and without 0 and N ∞ = N ∪ {∞}.
In this paper we deal with LTL extended with past time operators.The syntax of LTL with past (Full LTL) is where p ranges over a set of atomic propositions AP.An LTL formula is a propositional logic formula over AP extended by the operators φ (next) which checks that φ holds in the next state and φ 1 U φ 2 (until) that requires φ 2 to hold at some state in the future and that in all states up to that state φ 1 holds.Additionally there are the past time operators φ (previously) which checks that φ did hold in the previous state and φ 1 S φ 2 (since) which enforces that φ 2 did hold at some point in the past and φ 1 held at every state since then.In order to keep following automaton constructions and proofs compact we defined only a minimal fragment of LTL.Other common LTL and Past LTL operators  (globally),  (finally), R (release),  (globally in the past),  (once in the past) and S w (weak since) can be expressed by the operators included above (see [19]).
Given an infinite word w ∈ Σ ω , where the alphabet is Σ = 2 AP , and given an atomic proposition a ∈ AP we use w(t) to reference the letter of w at position t.We write p |= w(t) whenever p ∈ w(t).Given a finite word s ∈ Σ * and a finite or an infinite word w ∈ Σ * ∪ Σ ω we use sw for the concatenation of s followed by w. s is a prefix of w, denoted by s ⊑ w iff w = sw ′ for some w ′ ∈ Σ * ∪ Σ ω .
A pointed word (w, t) is a pair consisting of a word w and a position t ∈ N + .We define the semantics of LTL associating pointed words to formulas as follows: Besides Full LTL we will investigate the following fragments of Full LTL: -Future LTL is Full LTL restricted to the operators ¬, ∧, , U.
-Past LTL is Full LTL restricted to the operators ¬, ∧, , S.
-Past LTL with Bounded Future, which is Past LTL with additionally the operator .

Well-known Monitor constructions
We revise the well-known monitor constructions for Future LTL, Past LTL and Past LTL with Bounded Future.
Future LTL.The standard monitor construction for LTL is described in [3] and it is called the LTL 3 construction.This construction aims at deciding the question whether (w, 1) |= φ.Therefore it iteratively receives w ∈ Σ ω , letter by letter, and calculates the verdicts ⊤ (meaning (w, 1) |= φ), ⊥ (meaning (w, 1) ̸ |= φ) or ?(meaning a proper answer cannot be given for the prefix received up to now).Formally the output of the monitor after consumption of a finite prefix s ⊑ w is In other words the verdict domain B 3 = {⊤, ⊥, ?} encodes the set of possible outcomes of a monitoring question which are still possible after having processed prefix s of w: ⊤ = {tt}, ⊥ = {ff }, ?= {tt, ff }.We will use these symbols with these meanings also for the further monitoring approaches throughout this paper.The LTL 3 construction works as follows.First, the formula φ and its negation ¬φ are transformed into Alternating Büchi Automata by the standard LTL translation [15], which are then further transformed to Nondeterministic Büchi Automata (NBA).The monitor generation preprocesses each NBA determining which states are empty, (i.e.those states from which it is not possible to access accepting states infinitely often) which are removed from the automaton, resulting in an incomplete NFA, which is then determinized.Finally, the monitor is constructed as the product monitor of the resulting automata for φ and ¬φ.In those state pairs where the state of the negated formula is empty the monitor casts the verdict ⊤ as the formula cannot be breached anymore for the received prefix.In those pairs where the state of the non-negated monitor is  Monitor for φ = p U q with the LTL3 construction [3].Up left: NBA of φ, Up right: NBA of ¬φ, bottom: Monitor generated from the product automaton.Empty states of the NBAs are marked gray.States of the monitor are marked according to their outputs: Orange for ?; green for ⊤, red for ⊥.
empty ⊥ is cast, as the formula cannot be satisfied anymore.Otherwise, when both states are non-empty ? is printed.An example of the monitor construction can be found in Fig. 1.
These monitors are called impartial because the monitor does not output a final verdict (⊤ or ⊥) as long as the corresponding LTL formula is not satisfied or violated for all extensions of the observed word.These monitors are also anticipatory because the monitor yields the final verdict at the first moment at which all extensions of the consumed prefix satisfy the verdict.
Past LTL The standard monitor construction for Past LTL [13] also receives the word letter by letter but evaluates (w, t) |= φ at every step t, printing the outcome.In [13] the monitor is described as an imperative program that uses an array as central data structure which stores the current value (true or false) for every sub-formula of the given Past LTL formula φ.The program then receives the input word letter by letter and calculates bottom-up the new value of each sub-expression at the new instant, ultimately producing the verdict for the root formula.The size of the mentioned array data structure is the number of subformulas of a Past LTL formula and hence finite, so the imperative monitor can directly be seen as Moore machine.The state of the Moore machine is given by the current value of all sub-formulas.Consider the Past LTL formula p S ¬p over AP = {p, q}.The state is given by a 4-tuple containing the current evaluation of the sub formulas (p, ¬p, ¬p, pS ¬p).The value of the first two entries is dependent on the current input letter.The value of the third entry is the last value of the second entry and the value of the last entry is true iff it was true before and the first entry is true or if the third entry is true.The resulting automaton is depicted in Fig. 2.
Past LTL with Bounded Future Note that introducing a next operator may make the evaluation of φ at a certain timestamp dependent on the input at a later position.We can statically determine an upper bound ND(φ) of future states which are required for evaluation of a formula φ by counting the maximal depth of nested nexts adjusted by the number of surrounding previous operators (next depth) in the syntax tree of the formula: - For example for φ = ((p)S q)∧p we have ND(φ) = 2, because (depending on the evaluation of the since) it may be necessary to know at most two states of the word in advance.For φ ′ = q we get ND(φ ′ ) = 0 because φ ′ is only dependent on the current position of the word.
Note that if for a formula ND(φ) = k is positive, then the formula φ ′ =  k φ ( k is used as syntactic sugar for a composition of k previous operators) which expresses that φ was true k steps in the past can be rewritten to a Past LTL formula, without next operator.Therefore the next operators can be moved inside the other operators (which is possible for all given operators without changing the semantics of the formula) until a sub-formula ψ is contained, which can then be substituted by ψ.For φ = ((p)S(q))∧p from above one could construct  2 φ =  2 (((p)S q)∧p) = (((p)S q)∧p) = (((p) S q) ∧ p) = ((p S  2 q) ∧ p).This observation allows to transform a Past LTL formula with bounded future φ into a Past LTL formula φ ′ =  ND(φ) φ and build the corresponding monitor with the algorithm described previously.Due to the equivalence (w, t) |= φ ′ ⇐⇒ (w, t − ND(φ)) |= φ the resulting monitor still produces the output sequence (w, 1) |= φ, (w, 2) |= φ . . .but with a ND(φ) offset to receiving the corresponding input letters.

Initial and Recurrent Monitoring
Note that the monitor construction for Past LTL differs from the construction for Future LTL.The LTL 3 monitor attempts to answer the same question (w, 1) |= φ at each step.We call this initial monitoring.The Past LTL monitor instead continuously answers a different question, i.e. if the formula is satisfied from the current position t ∈ N + ((w, t) |= φ).We call this concept recurrent monitoring.It makes sense especially for Past LTL monitoring, where the monitor can always give the conclusive verdict ⊤ or ⊥ for the current state (in difference to LTL 3 ).In general, recurrent monitoring has advantages for the monitoring process, because it checks a property with respect to a certain position in the word.Hence a breach of the LTL property is related to a specific position in the trace and not for the whole trace in general.More importantly, the monitor can also recover from errors at previous positions and continue monitoring the trace after detection of a violation.
Consider for example a robot system and a property that states whether the robot is not too close to any objects.The intention of this monitor is to be able to react (or perhaps to later inspect log data).This problem is better cast as a recurrent monitoring problem, where the monitor raises an alarm at all positions where the robot does not satisfy a property.
We now investigate the opportunities of recurrent monitoring more thoroughly.First we define initial and recurrent monitoring formally.The monitoring problem is characterized by a function ω : Σ * → B 3 from finite prefixes received by the monitor to the usual Definition 1 (Initial LTL monitoring).Given an LTL specification φ, the following function ω init φ : Σ * → B 3 is called the initial LTL monitoring function: The initial LTL monitoring problem deals with providing the set of possible verdicts for (sw, 1) |= φ given a finite prefix s.The set is naturally the set of the verdicts for all possible infinite completions of the given prefix.Note that for two finite words s 1 ⊑ s 2 , ω init φ (s 1 ) ⊇ ω init φ (s 2 ) holds by definition, i.e. when calculating ω init φ repeatedly on growing traces, the set of verdicts gets refined as the observed prefix gets longer.
We define next recurrent monitoring as the problem where the property is checked at the position up to which the monitored trace has received events.Definition 2 (Recurrent LTL monitoring).Given an LTL specification φ, the following function ω rec φ : Σ * → B 3 is called the recurrent monitoring function: 2 differs from Def. 1 since |= is checked at position |s| currently received by the monitor, which is the traditional approach for monitoring Past LTL.For Past LTL, only states from the past are necessary for the evaluation and hence after receiving s it is always possible to cast a certain verdict (⊤, ⊥).However this is not the case for Future LTL or Past LTL with bounded future, where the recurrent verdict for position |s| may then yield the uncertain verdict {tt, ff } (a.k.a.?).We propose an extension of the recurrent monitoring where the verdict that the monitor must compute is shifted by a constant offset Definition 3 (Recurrent LTL monitoring with constant offset).Given an LTL specification φ and k ∈ Z, the recurrent k-offset monitoring function Note that the recurrent LTL monitoring function from Def. 2 is equivalent to the 0-offset LTL monitoring function from Def. 3.
Another degree of generalization of the recurrent monitoring results if we require the monitor to be able to return the best possible answer about any position that cannot be predicted upfront (that is, the monitored state is fully independent from the monitoring state).
Definition 4 (Random Access Recurrent LTL monitoring).Given an LTL specification φ, the random access recurrent monitoring function ω φ : This definition is a generalization of all previous definitions as i can be fixed with the parameter 1, |s|, |s| + k to receive the previous monitoring functions.
All previous definitions indeed are not restricted to any fragments of LTL.However, it is trivial to perform initial monitoring for Past LTL and in general it is useless to do 0-offset recurrent monitoring for arbitrary Future LTL formulas.On the other hand, it makes sense to apply k-offset or random recurrent monitoring to Past LTL with bounded future or even for full LTL, tolerating sometimes ?verdicts, depending on the property and the chosen offset.
We now introduce an abstract notion of RV monitor.For the purposes of this paper, a monitor receives a system trace iteratively (either online or offline) maintains internally a state which represents the trace that has been received yet (State part) iteratively produces outputs (Question answering part) Definition 5 (Monitor).A monitor is a 6-tuple M = (Σ, Ω, Q, q 0 , δ, ω) where -Σ is a possibly infinite input alphabet.
-Ω is a possibly infinite output alphabet.
-Q is a possibly infinite state space.
q 0 ∈ Q is an initial state. - ω : Q → Ω is an output function.
A monitor is essentially a Moore machine, except that input, output and state space are allowed to be infinite.Monitors with an infinite state spaces are common in Stream Runtime Verification [8,24] where the monitors are specified in terms of streams of arbitrary data types.Since monitors in Runtime Verification usually run for an arbitrary long time and resources are limited, it is crucial that their memory is independent of the trace length and can be bounded a-priori.The state maintained by a monitor depends on the inputs consumed (using sometimes knowledge about the system under analysis), but the monitor should not need to remember the whole trace.The output part of the monitor is tailored for the application.We call monitors, whose extended output function ω is equal to one of the functions defined above, initial, recurrent, k-offset recurrent and random access recurrent monitors.Note that for random access recurrent monitors there is no straight-forward implementation that "prints" the output.One alternative is that the monitor serves as an question-answering device.Another, which we present next, is that the monitor provides abstract information about future positions.

Anticipatory Monitoring
It is often desirable to detect failures of the system under observation as early as possible.In initial monitoring for LTL 3 this boils down to raising the verdicts ⊤, ⊥ as soon as all possible extensions lead to satisfaction (resp.violation).For recurrent monitoring there is also another dimension of anticipation.The output of a recurrent monitor is an evaluation of the pointed semantics of an LTL formula at increasing time instants.It is sometimes possible that a monitor that is asked to cast the verdict for (w, t) |= φ after having received a prefix of length t, is also able to cast a verdict for the next step (w, t + 1) |= φ (or even further steps in the future).
While in recurrent monitoring the verdict indicates that the LTL formula is satisfied or violated exactly at the required time instant, the user is often interested in knowing about a future violation as soon as possible.Consider for example a crash of a monitored robotic system.There one is not only interested that the monitor reports when a crash occurs, but also that it reports as soon as a crash is inevitable.Additionally, it may be very useful to know the number of steps in the future where there is surely no violation of the property.
Consider again pS¬p and the corresponding monitor in Fig. 2.This monitor yields verdict for (w, t) |= φ after having received t letters.When the monitor has received the prefix {p}{q} the monitor is in state 0100 and yields ⊥ = {ff }, since ({p}{q} . . ., 2) ̸ |= φ.However at this position it is already inevitable that the output at the next step ({p}{q} . . ., 3) |= φ is true.In Fig. 2 this can be seen as all possible successors of 0100 are accepting states.We seek monitors that not only generate information about the current verdict but also information about future verdicts.We define such anticipatory monitors as follows: Definition 6 (Anticipatory Monitor).Given a monitoring problem f : Σ * → V over an arbitrary verdict domain V, a monitor M = (Σ, Ω, Q, q 0 , δ, ω) with Ω = N + → 2 V is called an anticipatory monitor for f whenever for all inputs s ∈ Σ * and positions i ∈ N + , Note that anticipatory monitoring is defined relative to a given monitoring function f .The anticipatory monitor computes functions that predict the future verdicts of the original monitor which are possible after the current observation.In practice, implementing an anticipatory monitor requires to represent concisely the output alphabet Ω and the function ω that approximates f .One possibility is to predict only a fixed number of future states and to implicitly map all further instants to V (all verdicts are possible).Alternatively, we propose to compute the minimum number of future states which are guaranteed not to be ⊤ (⊤ meaning a crash) and the maximum number of steps until the next ⊤ is guaranteed to happen.Note that such abstractions may lead to imperfect anticipatory monitors, but the information provided may be very useful.

Anticipatory Monitors from Recurrent Monitors
We now present an algorithm to produce an anticipatory monitor for the k-offset recurrent monitoring problem.Our monitor outputs intervals (n, m) ∈ N ∞ ×N ∞ as an abstraction of the full output map.The interval indicates a lower and upper bound of letters that have to be received until the property is fulfilled.Even though we only handle the steps until the formula is fulfilled, the converse (providing the steps until the formula is violated) is analogous.
Definition 7 (Anticipatory (Recurrent) Interval Monitor).Let φ be an LTL property.A monitor M = (Σ, I N , Q, q 0 , δ, ω) with Note that n is the shortest sequence to a violation and m is the longest sequence without a violation.Also, n ≤ m.For example, in the case of φ = p S ¬p and the input word w = {p}{p}{q}{p}{q} . . .an anticipatory interval monitor would output (2, ∞)(2, ∞)(1, 1)(0, 0)(1, 1) . . . .This means in the first state after receiving input {p} it must take at least two further steps until φ is satisfied and it is also possible that φ will never be fulfilled.After receiving two further inputs {p} and {q} the output (1, 1) indicates that it is inevitable that in the next step the property will be fulfilled.Consequently after receiving a further letter we get (0, 0), meaning the property holds in the current state.In practical scenarios such a monitor helps detecting inevitable situations to undertake the right countermeasures (e.g. an emergency stop) before the failure occurs.
Likewise, the knowledge that a breach of the property is impossible for a time horizon also helps in some scenarios allowing for example a robot to accelerate.We can classify the meaning of an output interval (n, m) of an anticipatory recurrent monitor as follows: n = ∞ m = ∞ φ will never be satisfied in the future n ∈ N m = ∞ φ may be satisfied in the future but not before n steps n ∈ N m ∈ N + φ is inevitable, but not before n or after m steps n = 0 m = 0 φ is satisfied in the current state The anticipatory monitor M ′ with the described output behavior can be constructed directly from a given recurrent monitor M as follows.The state space and transition function of M ′ are taken without adjustments from those of M .The modified output function for M ′ is generated by a simple graph traversal from M : First, every state that was labeled with output ⊤ produces the output (0, 0).For the outputs of the other states a depth-first-search is performed.The output of such a state is then (n, m) where n is the minimum of the first interval component of all successor states plus 1, or 0, if the state is labeled with ? and m is the maximum of the second interval component plus 1.If a state is evaluated which is already on the DFS stack its output interval is (for the pending calculation) assumed to be (∞, ∞) since in this case an infinite non-⊤-labeled loop exists in the monitor.A formalization of the algorithm in pseudo-code can be found in Fig. 3.The resulting monitor is an anticipatory recurrent interval monitor according to Def. 6.
Method dfs(q, stack) if q ∈ stack then ω ′ (q) ← (∞, ∞); //only temporarily set else if ω(q) = ⊤ ω ′ (q) ← (0, 0); else for each q ′ ∈ succ(q) do dfs(q ′ , stack ∪{q}); end for //get min/max of first/second component of all successor outputs n ← if ω(q) =? then 0 else min q ′ ∈succ(q) {ω ′ (q ′ )._1} + 1; m ← max q ′ ∈succ(q) {ω ′ (q ′ )._2} + 1; ω ′ (q) ← (n, m); end if End Method for each q ∈ Q dfs(q, ∅) end for Fig. 3. Formalization of DFS-based algorithm for construction of the output function ω ′ of an anticipatory interval monitor The result of an application of the algorithm on the recurrent monitor from Fig. 2 is depicted in Fig. 4. The output of this monitor matches the output trace described above.Note that the anticipatory monitor can also be used to answer the standard recurrent LTL monitoring problem: every state where the predictive monitor casts (0, 0) is a state with verdict ⊤ in the original monitor.

Uncertainty and Assumptions
In this section we show how the anticipatory recurrent monitoring approach can be extended to handle uncertainty, in the sense that the content of some letters of the input word is unknown.We will also show how to exploit assumptions about the system to improve the monitoring process, where assumptions are invariants about the environment of the monitor and assumed to be always true.

Uncertainty
We model uncertain input events as subsets of Σ, which represent the set of possible inputs that actually happen.For example the input trace {{p, q}, {q}} {{p}} {∅, {p}, {q}, {p, q}} . . .encodes any trace where in the first step q holds but it is uncertain if p holds, in the second step p and not q holds (with total certainty) and where everything is possible in the third state (total uncertainty).
Definition 8 (Uncertain Anticipatory Recurrent Monitor).Let φ be an LTL property.A monitor M = (2 Σ , I N , Q, q 0 , δ, ω) is called an uncertain k-offset anticipatory recurrent monitor if for all inputs s ∈ (2 Σ ) * , ω(s) = (n, m) where, n = min{pos u | for some u |= s} m = max{pref u | for some u |= s} This definition extends anticipatory recurrent monitoring to the minimal and maximal distance to a ⊤-verdict over all possible concrete input words.Note that the definition is a more general version of Def. 7, which yields the same intervals when singleton sets (certain inputs) are provided.
The classical automata-theoretic approach to handle uncertainty is the power set construction, where a new monitor is built whose state space is the power set of the original monitor's state space.When an uncertain input is received the power set monitor changes to all possible successor states of the currently possible states.The main remaining detail is how the power set automaton can produce verdicts, i.e. how the intervals of the potential states of the original monitor can be combined.We show that it suffices to take the minimum and maximum of the interval bounds of the active states.This results in the following monitor construction.

Assumptions
Another aspect with practical impact in RV is how to exploit knowledge about the system into the monitoring process.This information usually includes (partial) knowledge about the state the system is currently in and which properties (inputs to the monitor) may hold in the current and subsequent states.For example, consider the assumption (p → q), which states that every state where proposition p holds is succeeded by a state in which q holds.This assumption implies, for example, that the input word {p, q}{p} . . .will never be passed to the monitor.Since several input words or continuations are excluded, assumptions help to produce more precise verdicts and detect failures earlier.Note that, of course, one could also detect traces where an assumption is not met, indicating a severe error in the whole monitoring setting.
Especially in the presence of uncertainty in the inputs assumptions are very useful to produce more precise (anticipatory) verdicts and recover from uncertainty in the input.For example, in our assumption, observing p allows to conclude that q will follow, allowing to better anticipate.Also, not observing q allows to deduce that p did not happen in the previous step, which reduces the uncertainty if the previous event was not properly received.
Additionally note that assumptions have to be explicitly handled by the monitoring algorithm, as they restrict the space of possible models, and hence cannot be encoded directly in the LTL formulas, for example as φ ′ = φ ass → φ or φ ′ = φ ass ∧ φ.Such an encoding would not allow the monitor to perform inferences about uncertain or future inputs, as it could never be sure if the assumption φ ass actually holds or not.
A general way to represent assumptions and system invariants is by a Kripke structure or equivalently a transition system.Definition 9 (Transition System).A Transition System over a finite input alphabet Σ is a tuple T = (Q, q 0 , δ) with -Q a finite state space.
q 0 ∈ Q an initial state.
A transition system T describes a subset of valid inputs T ⊆ Σ ω .For all words w ∈ T there is a path q 0 , q 1 , . . . in the system such that (q i , q i+1 , w(i + 1)) ∈ δ for all i ∈ N. Hence a transition system can be used as a very general way to express assumptions.Every assumption given in LTL can be used to build a corresponding transition system [19] (for simplicity we consider only safety formulas as assumptions).The transition system corresponding to the formula (p → q) is depicted in Fig. 6.
We can further refine Def.7 now to also support assumptions given in form of a transition system T : Definition 10 (Uncertain Anticipatory Recurrent Monitor with Assumptions).Let φ be an LTL specification and let T be a transition system over 2 Σ .A monitor M = (2 Σ , I N , Q, q 0 , δ, ω) is called an uncertain k-offset anticipatory recurrent monitor under assumption T whenever for every s ∈ Def. 10 allows to only care about words which are also valid inputs according to the transition system.This definition is a further generalization of Def. 8 and both are equivalent for the uninformative transition system T = (2 Σ ) ω .
To exploit the transition system that encodes the assumption we make use of a product construction, where states are tuples of the original monitor's states and transition system states.We only preserve transitions which are allowed by the transition system.
Since the existence of assumptions improves the anticipatory capabilities of the resulting monitor we take care already at the generation of the anticipatory monitor.Given a recurrent monitor M = (Σ, V, Q, q 0 , δ, ω) for a specification φ, and a transition system T = (Q T , q T 0 , δ T ) over 2 Σ we first construct the recurrent monitor under assumption M T = (Σ, V ∪ {↓}}, Q × Q T ∪ {q ⊥ }, (q 0 , q T 0 ), δ ′ , ω ′ ) with δ ′ (q, l) = (δ(q M , l), q ′ T ) if q = (q M , q T ) ̸ = q ⊥ and (q T , q ′ T , l) ∈ δ T q ⊥ otherwise ω ′ (q) = ω(q M ) if q = (q M , q T ) ̸ = q ⊥ ↓ otherwise where q ⊥ serves as an error state and ↓ indicates the breach of an assumption.Together with the constructions from the previous sections this monitor builds the basis for an uncertain recurrent anticipatory monitor under assumption.
Theorem 3. The construction from Fig. 3 applied to a k-offset recurrent monitor under assumption M T and the subsequent application of the construction from Th. 2 yields an uncertain k-offset anticipatory recurrent monitor under assumption T .
In the example from Fig. 5 considering the assumption leads to the monitor run in which the grey transitions do not exist anymore in the adjusted recurrent anticipatory monitor.This is because the second input is {p} which implies that the first letter could not have been {p, q}, which had lead to the state labeled with (2, ∞).The uncertain monitor is capable of removing successors that would violate the assumptions and determines more precise verdicts.In particular, this monitor can detect a satisfaction after receiving the second letter (output (0, 0)).Also, after receiving the third letter this monitor can conclude that the property is fulfilled either there or at the subsequent step (output (0, 1)).

Conclusion
In this paper we have studied the concept of recurrent monitoring where monitors produce verdicts for the property at all positions.This is a promising concept both theoretical and practical, particularly for Past LTL with bounded future, as it provides more information on the position in a trace where a property violation occurs and typically allows the monitor to recover afterwards.
To be able to detect situations of interest (e.g.crashes of the observed system) as early as possible we extended the concept with a notion of anticipation and proposed a monitor construction which gives estimates about the number of steps until the next situation of interest could occur, and if it is even inevitable.We presented constructions such that these monitors can further handle uncertainty in inputs, as well as assumptions about the system, and showed how these can lead to more precise verdicts.
In general solving the recurrent word problem for arbitrary (future and past) LTL requires unbounded memory.Future work includes studying useful bounded monitors that approximate this problem.Also, we would like to extend our monitoring notion, particularly under uncertainty and assumptions, to more complex recurrent monitoring settings, like Stream Runtime Verification.We also aim at implementation, particularly of an SRV engine, and an empirical evaluation on realistic case studies.

Fig. 1 .
Fig.1.Monitor for φ = p U q with the LTL3 construction[3].Up left: NBA of φ, Up right: NBA of ¬φ, bottom: Monitor generated from the product automaton.Empty states of the NBAs are marked gray.States of the monitor are marked according to their outputs: Orange for ?; green for ⊤, red for ⊥.

Fig. 4 .
Fig. 4. Anticipatory monitor for p S ¬p based on the monitor from Fig. 2. The states are labeled with their corresponding interval outputs.

Fig. 5 .
Fig. 5. Run of the anticipatory recurrent monitor from Fig. 4 with uncertain inputs.The states in which the monitor is potentially located in a time step and their outputs are drawn on top of each other.The assumption (see section 5.2) (p → q) eliminates the grey states and transitions and leads to more precise verdicts.