  Runtime verification or runtime monitoring equips safety-critical
cyber-physical systems to augment design assurance measures and ensure
operational safety and security. Cyber-physical systems have interaction
failures, attack surfaces, and attack vectors resulting in unanticipated
hazards and loss scenarios. These interaction failures pose challenges to
runtime verification regarding monitoring specifications and monitoring
placements for in-time detection of hazards. We develop a well-formed workflow
model that connects system theoretic process analysis, commonly referred to as
STPA, hazard causation information to lower-level runtime monitoring to detect
hazards at the operational phase. Specifically, our model follows the DepDevOps
paradigm to provide evidence and insights to runtime monitoring on what to
monitor, where to monitor, and the monitoring context. We demonstrate and
evaluate the value of multilevel monitors by injecting hazards on an autonomous
emergency braking system model.
