On the Semantics of Matching Trace Monitoring Patterns

• Published in: Runtime Verification pp. 9 - 21
• Main Authors: Avgustinov, Pavel, Tibble, Julian, de Moor, Oege
• Format: Book Chapter
• Language: English
• Published: Berlin, Heidelberg Springer Berlin Heidelberg 2007
• Series: Lecture Notes in Computer Science
• Subjects: Context Free Grammar; Free Variable; Regular Expression; Runtime Veri; Temporal Logic
• ISBN: 9783540773948; 3540773940
• ISSN: 0302-9743; 1611-3349
• DOI: 10.1007/978-3-540-77395-5_2

Trace monitor specifications consist of a pattern that is matched against the trace of events of a subject system. We investigate the design choices in defining the semantics of matching patterns against traces. Some systems use an exact-match semantics (where every relevant event must be matched by the pattern), while others employ a skipping semantics (which allows any event to be skipped during matching). The semantics of exact-match is well established; here we give a semantics to skipping by providing a translation to exact-match. It turns out the translation is not surjective: a pattern language with skipping semantics is strictly less expressive than one with exact-match semantics. That proof suggests the addition of a novel operator to a skipping language that makes it equivalent to exact-match. Another design decision concerns the atoms in patterns: are these unique runtime events, or can multiple atoms match the same runtime event? Many implementations have chosen predicates for atoms, and then overlap is natural. There are some exceptions, however, and we examine the consequences of that design choice in some depth.