Synchronous Observers Revisited for Runtime Verification of Lustre Using STL

Abstract: Signal Temporal Logic (STL) is a popular formalism for the temporal safety properties of cyber-physical systems, most often used for runtime verification. In the synchronous family of languages, safety properties are instead expressed as synchronous observers, modules composed with a program for static verification, which are also runnable specifications suitable for runtime verification, though this use is rarely explored. We present a technique for compiling the synchronous fragment of STL (SSTL) into synchronous observers in the dataflow language Lustre. Unlike previous work, we allow arbitrary nesting of bounded SSTL properties via modular compilation, and admit a globally unbounded outer operator for online monitoring; the resulting observers serve both runtime verification and, as a by-product, static verification with the Kind2 model checker. We further contribute an interactive visualiser that renders a property's three-valued verdict over an editable trace, and evaluate on two case studies from the literature: a spring-mass system and a car-following cruise controller.

• The paper presents a sound and complete synthesis method that compiles arbitrarily nested bounded SSTL formulas into three-valued synchronous Lustre observers with definitive verdicts as soon as observed traces permit.
• The observers compose reusable until-based monitoring nodes, support an unbounded outer globally operator through a shift register, and remain compatible with Kind2 for static verification alongside runtime checking.
• Evaluation on spring-mass and adaptive-cruise-control cases found complete agreement between lv6 runtime execution and Kind2, with bounded properties settling early and average costs of 79.2 ns/tick and 32.9 ns/tick.

This paper presents an overview technique that compiles arbitrarily nested formulas in the bounded fragment of Synchronous Signal Temporal Logic (SSTL) into synchronous observers written in Lustre, enabling runtime verification of a system by an artefact expressed in the system's own language (2608.12693). The observers carry a three-valued (Kleene) streaming semantics that issues definitive verdicts as early as the trace permits, and—because they are ordinary Lustre—remain dischargeable by the Kind2 model checker as a static-verification by-product. The work is positioned against Bellanger et al., who synthesize observers for non-nested STL operators only; the contributions here are arbitrary nesting of bounded operators, a language-native executable specification usable online, and support for an unbounded outer $\square$ operator via a shift-register construction.

Background and semantics

The paper works in SSTL, the discrete-time abstraction of STL in which time ranges over ticks rather than real time; under robustness conditions, SSTL agrees with continuous STL on satisfaction, making it a sound and complete discrete abstraction (2608.12693). The logic comprises atomic predicates, negation, conjunction, bounded $\square_{[a,b]}$, bounded $\diamondsuit_{[a,b]}$, and bounded until $\mathbf{U}_{[a,b]}$, with $\diamondsuit$ and $\square$ derived from until via the standard identities $$\diamondsuit_{[a,b]}\varphi \equiv \top\,\mathbf{U}_{[a,b]}\,\varphi$$ and $$\square_{[a,b]}\varphi \equiv \neg(\top\,\mathbf{U}_{[a,b]}\,\neg\varphi)$$.

Because bounded operators are forward-looking, an online observer anchored at tick $t$ cannot always decide immediately. The paper adopts a three-valued semantics in the style of LTL$_3$: at each tick the verdict is def_true, def_false, or unknown, where unknown means the observed prefix does not yet force an outcome under any continuation. Verdicts are represented as a $\square_{[a,b]}$0 pair of Booleans, which makes negation a component swap at no state cost and preserves a mutual-exclusion invariant (never both definitive). The temporal operators reduce to explicit enumerations over the bounded window: the positive verdict of $\square_{[a,b]}$1 is a witness disjunction, while the negative verdict closes in two ways—early termination, when the precondition fails before any witness (possibly well before the horizon), and window expiry, when no witness appears by $\square_{[a,b]}$2. This two-mode closure is what allows verdicts to settle ahead of the formula horizon.

A notable methodological choice is that the correctness argument is framed as two proof obligations—leaf-level agreement with the explicit semantics, and soundness of substituting a child's verdict pair for an atom—rather than a bespoke proof per construction.

Observer synthesis

The central observation is that in discrete time, a nested formula unrolls into a finite collection of non-nested obligations, each watching a fixed absolute window of ticks. A single reusable Lustre node, until_leaf, implements one such obligation: it latches found on the first in-window tick where the postcondition holds while an alive bit (the running precondition) is still true, and emits def_false either on precondition breakage or on window closure. All three bounded operators are degenerate cases of this primitive: $\square_{[a,b]}$3 uses a trivial precondition, and $\square_{[a,b]}$4 is obtained by feeding $\square_{[a,b]}$5 and swapping the verdict outputs.

Composition proceeds bottom-up, one Lustre node per subformula, mirroring the formula tree. $\square_{[a,b]}$6 and $\square_{[a,b]}$7 nodes spawn one child copy per start offset in their window—so the leaf count is the product of the window widths of the outer $\square_{[a,b]}$8 operators—and aggregate by the Kleene rules. Intermediate until operators require a latch-freezing mechanism, since a branch is a valid witness only if the precondition held up to the witness tick, which is knowable only at that tick. Boolean connectives are additive in leaf count rather than multiplicative, so compound observers cost no more than their components.

Correctness is established by a leaf-correctness lemma, a convergence-and-causality lemma (verdicts are monotone, change at most once from unknown, and are fixed from the horizon $\square_{[a,b]}$9), and a compositional substitution lemma, combined by induction into a soundness-and-completeness theorem: for every bounded SSTL formula and every tick, the observer's verdict pair equals the explicit three-valued semantics. The convergence lemma also underpins the unbounded extension.

Unbounded globally via shift register

A truly unbounded $\diamondsuit_{[a,b]}$0 is an infinite conjunction of inner-observer copies started at every tick. Since each copy resolves within the inner horizon $\diamondsuit_{[a,b]}$1 and is constant thereafter, at any tick only the $\diamondsuit_{[a,b]}$2 copies started within the last $\diamondsuit_{[a,b]}$3 ticks are live. The paper exploits this with a shift register of $\diamondsuit_{[a,b]}$4 slots per leaf: slot $\diamondsuit_{[a,b]}$5 holds the running state of the copy started $\diamondsuit_{[a,b]}$6 ticks ago, slot $\diamondsuit_{[a,b]}$7 injects fresh copies, and slot $\diamondsuit_{[a,b]}$8 emits final verdicts. The unbounded operator itself reduces to a single latch over the inner negative verdict, since on an infinite run the only definitive verdict is a latching FALSE—satisfaction is unobservable online. The construction is therefore a falsification monitor for free-running systems, and the paper reports per-window diagnostics (the tick a window closes violated) as more informative than the aggregate.

Visualisation tooling

Because nested observers have overlapping windows and verdicts that close at ticks with no obvious relation to syntactic bounds, the paper contributes a browser-based visualiser that synthesises the observer in-browser, runs it over an editable trace, and renders a per-copy Gantt chart with three-valued cell colouring. A compare action runs the generated Lustre through the lv6 compiler and overlays its verdict. The authors are explicit that this tool is for design-time intuition, not verification.

Evaluation

Eight observers across two case studies—a damped spring-mass system and a car-following ACC scenario under emergency braking—were executed online under lv6 and cross-checked statically with Kind2; the runtime and static verdicts agree on every property, including the mutual-exclusion invariant at every tick.

Property	Nesting	Verdict	Horizon	Settles
P1	$\diamondsuit_{[a,b]}$9	T	9	tick 7
P3	$\mathbf{U}_{[a,b]}$0	T	23	tick 8
Q1	$\mathbf{U}_{[a,b]}$1	T	10	tick 7
Q3	$\mathbf{U}_{[a,b]}$2	T	15	tick 12
P2$\mathbf{U}_{[a,b]}$3, Q2$\mathbf{U}_{[a,b]}$4	unbounded $\mathbf{U}_{[a,b]}$5, tightened	F (latched)	—	ticks 7, 14

Two quantitative claims stand out. First, every bounded property settles strictly before its horizon, with the largest margin on the most deeply nested property P3—definitive fifteen ticks before $\mathbf{U}_{[a,b]}$6—supporting the paper's central claim that the three-valued semantics commits early. Second, per-tick cost is constant and small: compiled to C via the lv6 back end, observers average 79.2 ns/tick (spring-mass) and 32.9 ns/tick (car-following) on a 2020 MacBook Pro, with cost tracking leaf count rather than nesting depth; even the slowest observer (206.5 ns/tick) is far below millisecond-scale control periods. The deliberately tightened variants P2$\mathbf{U}_{[a,b]}$7 and Q2$\mathbf{U}_{[a,b]}$8 are falsified at the exact tick the offending window closes, confirming that the satisfied properties are not vacuous.

Limitations and open questions

The paper concedes three limitations. The leaf count is the product of window widths, so wide windows such as $\mathbf{U}_{[a,b]}$9 cause state blow-up; the authors observe that sibling leaves of one operator differ only in offset and read the same child stream, so contained windows are redundant and could share state, but this optimisation is left open. Both case studies model the plant inside Lustre as a closed system, so the observers monitor internally generated signals rather than sensor inputs from a genuine open system—deployability as true online monitors is asserted by construction but not demonstrated. Finally, the work operates entirely in the sampled discrete domain; extending to continuous STL robustness semantics via robustness degrees is unaddressed. A further unstated cost is the naive exponential unrolling in nesting depth, which the case studies do not stress.

Conclusion

The paper delivers a sound and complete synthesis of three-valued Lustre observers for arbitrarily deep bounded SSTL, with an unbounded falsification-only outer $\diamondsuit$0, validated by matched runtime (lv6) and static (Kind2) verdicts and sub-microsecond per-tick cost. Its distinctive position is that the monitor is co-compiled with the system in the same synchronous language, eliminating the modelling gap between property and program that afflicts SMT-based and trace-based STL tooling. The principal open questions are leaf sharing to tame window-width blow-up, monitoring of genuinely open systems, and a robustness-based extension beyond the Boolean sampled domain.