[PPT] - A Uniform Substitution Calculus for Differential Dynamic Logic Andr PowerPoint Presentation

SLIDE 1

A Uniform Substitution Calculus for Differential Dynamic Logic

Andr´ e Platzer

aplatzer@cs.cmu.edu Computer Science Department Carnegie Mellon University, Pittsburgh, PA

The Secret for Simpler Sound Hybrid Systems Provers

0.2 0.4 0.6 0.8 1.0

0.1 0.2 0.3 0.4 0.5

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 1 / 27

SLIDE 2

Outline

1

Cyber-Physical Systems

2

Uniform Substitution Calculus for Differential Dynamic Logic Uniform Substitution Calculus Axiom vs. Axiom Schemata Uniform Substitutions Differential Axioms Examples

3

Differential-form Differential Dynamic Logic Semantics: Local Differential Substitution Lemmas Static Semantics

4

Summary

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 1 / 27

SLIDE 3

Outline

1

Cyber-Physical Systems

2

Uniform Substitution Calculus for Differential Dynamic Logic Uniform Substitution Calculus Axiom vs. Axiom Schemata Uniform Substitutions Differential Axioms Examples

3

Differential-form Differential Dynamic Logic Semantics: Local Differential Substitution Lemmas Static Semantics

4

Summary

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 1 / 27

SLIDE 4

CPS Analysis

Challenge (CPS)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

2 4 6 8 10 t 0.8 0.6 0.4 0.2 0.2

a

2 4 6 8 10 t 0.2 0.4 0.6 0.8 1.0v 2 4 6 8 10 t 2 4 6 8

p

px py Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 2 / 27

SLIDE 5

CPS Analysis

Challenge (CPS)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

2 4 6 8 10 t 0.8 0.6 0.4 0.2 0.2

a

2 4 6 8 10 t 1.0 0.5 0.5

Ω

2 4 6 8 10 t 0.5 0.5 1.0

d

dx dy Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 2 / 27

SLIDE 6

CPS Analysis

Differential Dynamic Logic

x = o ∧ b > 0

init

→

if(tooClose(x, o)) a := −b
discrete control

; x′ = v, v′ = a

ODE

∗ x = o

post

Seq. Compose Nondet. Repeat [α]φ φ α

2 4 6 8 10 t 0.8 0.6 0.4 0.2 0.2

a

2 4 6 8 10 t 0.2 0.4 0.6 0.8 1.0v 2 4 6 8 10 t 2 4 6 8

p

px py Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 3 / 27

SLIDE 7

Key Contributions

Q: How to build a prover with a small soundness-critical core? A: Uniform substitution [Church] Q: How to enable flexible yet sound reasoning? A: Axioms with local meaning [Philosophy, Algebraic Geometry] Q: What’s the local meaning of a differential equation? A: Differential forms [Differential Geometry] Q: How to do hybrid systems proving? A: Uniform substitution calculus for differential dynamic logic Q: What’s the impact of uniform substitution on a prover core? A: 65 989 ց 1 682 LOC (2.5%) [KeYmaera X]

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 4 / 27

SLIDE 8

Outline

1

Cyber-Physical Systems

2

Uniform Substitution Calculus for Differential Dynamic Logic Uniform Substitution Calculus Axiom vs. Axiom Schemata Uniform Substitutions Differential Axioms Examples

3

Differential-form Differential Dynamic Logic Semantics: Local Differential Substitution Lemmas Static Semantics

4

Summary

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 4 / 27

SLIDE 9

Differential Dynamic Logic: Comparison

[x := f ]p(x) ↔ p(f ) [?q]p ↔ (q → p) [a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) [a; b]p(¯ x) ↔ [a][b]p(¯ x) [a∗]p(¯ x) ↔ p(¯ x) ∧ [a][a∗]p(¯ x) [a](p(¯ x) → q(¯ x)) → ([a]p(¯ x) → [a]q(¯ x)) [a∗](p(¯ x) → [a]p(¯ x)) → (p(¯ x) → [a∗]p(¯ x)) p → [a]p [:=] [x := θ]φ(x) ↔ φ(θ) [?] [?H]φ ↔ (H → φ) [∪] [α ∪ β]φ ↔ [α]φ ∧ [β]φ [;] [α; β]φ ↔ [α][β]φ [∗] [α∗]φ ↔ φ ∧ [α][α∗]φ K [α](φ → ψ) → ([α]φ → [α]ψ) I [α∗](φ → [α]φ) → (φ → [α∗]φ) V φ → [α]φ [′] [x′ = θ]φ ↔ ∀t≥0 [x := x(t)]φ CADE’15 LICS’12

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 6 / 27

SLIDE 10

Differential Dynamic Logic: Comparison

[x := f ]p(x) ↔ p(f ) [?q]p ↔ (q → p) Axiom [a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) [a; b]p(¯ x) ↔ [a][b]p(¯ x) [a∗]p(¯ x) ↔ p(¯ x) ∧ [a][a∗]p(¯ x) [a](p(¯ x) → q(¯ x)) → ([a]p(¯ x) → [a]q(¯ x)) [a∗](p(¯ x) → [a]p(¯ x)) → (p(¯ x) → [a∗]p(¯ x)) Axiom p → [a]p [:=] [x := θ]φ(x) ↔ φ(θ) [?] [?H]φ ↔ (H → φ) Schema [∪] [α ∪ β]φ ↔ [α]φ ∧ [β]φ [;] [α; β]φ ↔ [α][β]φ [∗] [α∗]φ ↔ φ ∧ [α][α∗]φ K [α](φ → ψ) → ([α]φ → [α]ψ) I [α∗](φ → [α]φ) → (φ → [α∗]φ) Schema V φ → [α]φ [′] [x′ = θ]φ ↔ ∀t≥0 [x := x(t)]φ CADE’15 LICS’12

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 6 / 27

SLIDE 11

Axiom vs. Axiom Schemata

[a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) Axiom [α ∪ β]φ ↔ [α]φ ∧ [β]φ Schema p → [a]p Axiom φ → [α]φ. . . Schema

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 7 / 27

SLIDE 12

Axiom vs. Axiom Schemata

[a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) Axiom [α ∪ β]φ ↔ [α]φ ∧ [β]φ Schema p → [a]p Axiom φ → [α]φ. . . Schema Pattern match formulas for shape α ∪ β Placeholder α schema variable matcher Same instance

f φ in

all places

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 7 / 27

SLIDE 13

Axiom vs. Axiom Schemata

[a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) Axiom [α ∪ β]φ ↔ [α]φ ∧ [β]φ Schema p → [a]p Axiom φ → [α]φ. . . x = 0 → [y′ = 5]x = 0 x = y → [y′ = 5]x = y x = z → [y′ = 5]x = z Schema Pattern match formulas for shape α ∪ β Placeholder α schema variable matcher Same instance

f φ in

all places

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 7 / 27

SLIDE 14

Axiom vs. Axiom Schemata

[a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) Axiom [α ∪ β]φ ↔ [α]φ ∧ [β]φ Schema p → [a]p Axiom φ → [α]φ. . . x = 0 → [y′ = 5]x = 0 × x = y → [y′ = 5]x = y x = z → [y′ = 5]x = z special vs. degenerate instances rule out by side conditions Schema Pattern match formulas for shape α ∪ β Placeholder α schema variable matcher Same instance

f φ in

all places

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 7 / 27

SLIDE 15

Axiom vs. Axiom Schemata: Formula vs. Algorithm

[a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) Axiom 1 Formula [α ∪ β]φ ↔ [α]φ ∧ [β]φ Schema Algorithm p → [a]p Axiom φ → [α]φ. . . x = 0 → [y′ = 5]x = 0 × x = y → [y′ = 5]x = y x = z → [y′ = 5]x = z special vs. degenerate instances rule out by side conditions Schema Pattern match formulas for shape α ∪ β Placeholder α schema variable matcher Same instance

f φ in

all places Generic formula. No exceptions.

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 7 / 27

SLIDE 16

Generic Formulas in Axioms are like Generic Points

An analogy from algebraic geometry Axiom schemata with side conditions are like concrete points ∃x ax2 + bx + c = 0 iff b2 ≥ 4ac except a = 0 except b = 0 except c = 0 This Way Axioms The generic formulas in axioms are like generic points ax2 + bx + c = 0 iff x = −b ± √ b2 − 4ac/(2a) Paying attention during substitutions to avoid degenerates (no /0, √−1)

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 8 / 27

SLIDE 17

Axioms vs. Axiom Schemata: Philosophy Affects Provers

Soundness easier: literal formula, not instantiation mechanism An axiom is one formula. Axiom schema is a decision algorithm. Generic formula, not some shape with characterization of exceptions No schema variable or meta variable algorithms No matching mechanisms / unification in prover kernel No side condition subtlety or occurrence pattern checks (per schema) × Need other means of instantiating axioms: uniform substitution (US) US + renaming: isolate static semantics US independent from axioms: modular logic vs. prover separation More flexible by syntactic contextual equivalence × Extra proofs branches since instantiation is explicit proof step

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 9 / 27

SLIDE 18

Axioms vs. Axiom Schemata: Philosophy Affects Provers

Soundness easier: literal formula, not instantiation mechanism An axiom is one formula. Axiom schema is a decision algorithm. Generic formula, not some shape with characterization of exceptions No schema variable or meta variable algorithms No matching mechanisms / unification in prover kernel No side condition subtlety or occurrence pattern checks (per schema) × Need other means of instantiating axioms: uniform substitution (US) US + renaming: isolate static semantics US independent from axioms: modular logic vs. prover separation More flexible by syntactic contextual equivalence × Extra proofs branches since instantiation is explicit proof step Net win for soundness since significantly simpler prover

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 9 / 27

SLIDE 19

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US φ σ(φ) provided FV(σ|Σ(θ)) ∩ BV(⊗(·)) = ∅ for each operation ⊗(θ) in φ i.e. bound variables U = BV(⊗(·)) of operator ⊗ are not free in the substitution on its argument θ (U-admissible)

US

[a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) [x := x + 1 ∪ x′ = 1]x ≥ 0 ↔ [x := x + 1]x ≥ 0 ∧ [x′ = 1]x ≥ 0

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 11 / 27

SLIDE 20

Uniform Substitution: Definition expanded explicitly

σ(f (θ)) = (σ(f ))(σ(θ)) for function symbol f ∈ σ

def

= {· → σ(θ)}(σf (·)) σ(θ + η) = σ(θ) + σ(η) σ((θ)′) = (σ(θ))′ if σ V ∪ V′-admissible for θ σ(p(θ)) ≡ (σ(p))(σ(θ)) for predicate symbol p ∈ σ σ(C(φ)) ≡ σ(C)(σ(φ)) if σ V ∪ V′-admissible for φ, C ∈ σ σ(φ ∧ ψ) ≡ σ(φ) ∧ σ(ψ) σ(∀x φ) = ∀x σ(φ) if σ {x}-admissible for φ σ([α]φ) = [σ(α)]σ(φ) if σ BV(σ(α))-admissible for φ σ(a) ≡ σa for program constant a ∈ σ σ(x := θ) ≡ x := σ(θ) σ(x′ = θ & H) ≡ x′ = σ(θ) & σ(H) if σ {x, x′}-admissible for θ, H σ(α ∪ β) ≡ σ(α) ∪ σ(β) σ(α; β) ≡ σ(α); σ(β) if σ BV(σ(α))-admissible for β σ(α∗) ≡ (σ(α))∗ if σ BV(σ(α))-admissible for α

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 12 / 27

SLIDE 21

Uniform Substitution: Examples

[x := f ]p(x) ↔ p(f ) [x := x + 1]x = x ↔ x + 1 = x σ = {f → x + 1, p(·) → (· = x)} [x := f ]p(x) ↔ p(f ) [x := x2][(z := x+z)∗; z := x+yz]y≥x ↔ [(z := x2+z∗); z := x2+yz]y≥x2 with σ = {f → x2, p(·) → [(z := · + z)∗; z := · + yz]y ≥ ·} p → [a]p x ≥ 0 → [x′ = −1]x ≥ 0 σ = {a → x′ = −1, p → x ≥ 0} (−x)2 ≥ 0 [x′ = −1](−x)2 ≥ 0 by p(¯ x) [a]p(¯ x) σ = {a → x′ = −1, p(·) → (−·)2 ≥ 0}

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 13 / 27

SLIDE 22

Uniform Substitution: Examples

[x := f ]p(x) ↔ p(f ) [x := x + 1]x = x ↔ x + 1 = x σ = {f → x + 1, p(·) → (· = x)} [x := f ]p(x) ↔ p(f ) [x := x2][(z := x+z)∗; z := x+yz]y≥x ↔ [(z := x2+z∗); z := x2+yz]y≥x2 with σ = {f → x2, p(·) → [(z := · + z)∗; z := · + yz]y ≥ ·} p → [a]p x ≥ 0 → [x′ = −1]x ≥ 0 σ = {a → x′ = −1, p → x ≥ 0} (−x)2 ≥ 0 [x′ = −1](−x)2 ≥ 0 by p(¯ x) [a]p(¯ x) σ = {a → x′ = −1, p(·) → (−·)2 ≥ 0}

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 13 / 27

SLIDE 23

Uniform Substitution: Examples

[x BV := f ]p(x) ↔ p(f ) Clash [x := x + 1]x = x ↔ x + 1 = x σ = {f → x + 1, p(·) → (· = x FV )} [x := f ]p(x) ↔ p(f ) [x := x2][(z := x+z)∗; z := x+yz]y≥x ↔ [(z := x2+z∗); z := x2+yz]y≥x2 with σ = {f → x2, p(·) → [(z := · + z)∗; z := · + yz]y ≥ ·} p → [a]p x ≥ 0 → [x′ = −1]x ≥ 0 σ = {a → x′ = −1, p → x ≥ 0} (−x)2 ≥ 0 [x′ = −1](−x)2 ≥ 0 by p(¯ x) [a]p(¯ x) σ = {a → x′ = −1, p(·) → (−·)2 ≥ 0}

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 13 / 27

SLIDE 24

Uniform Substitution: Examples

[x := f ]p(x) ↔ p(f ) Clash [x := x + 1]x = x ↔ x + 1 = x σ = {f → x + 1, p(·) → (· = x)} [x := f ]p(x) ↔ p(f ) [x := x2][(z := x+z)∗; z := x+yz]y≥x ↔ [(z := x2+z∗); z := x2+yz]y≥x2 with σ = {f → x2, p(·) → [(z := · + z)∗; z := · + yz]y ≥ ·} p → [a]p x ≥ 0 → [x′ = −1]x ≥ 0 σ = {a → x′ = −1, p → x ≥ 0} (−x)2 ≥ 0 [x′ = −1](−x)2 ≥ 0 by p(¯ x) [a]p(¯ x) σ = {a → x′ = −1, p(·) → (−·)2 ≥ 0}

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 13 / 27

SLIDE 25

Uniform Substitution: Examples

[x := f ]p(x) ↔ p(f ) Clash [x := x + 1]x = x ↔ x + 1 = x σ = {f → x + 1, p(·) → (· = x)} [x := f ]p(x) ↔ p(f ) Correct [x := x2][(z := x+z)∗; z := x+yz]y≥x ↔ [(z := x2+z∗); z := x2+yz]y≥x2 with σ = {f → x2, p(·) → [(z := · + z)∗; z := · + yz]y ≥ ·} p → [a]p x ≥ 0 → [x′ = −1]x ≥ 0 σ = {a → x′ = −1, p → x ≥ 0} (−x)2 ≥ 0 [x′ = −1](−x)2 ≥ 0 by p(¯ x) [a]p(¯ x) σ = {a → x′ = −1, p(·) → (−·)2 ≥ 0}

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 13 / 27

SLIDE 26

Uniform Substitution: Examples

[x := f ]p(x) ↔ p(f ) Clash [x := x + 1]x = x ↔ x + 1 = x σ = {f → x + 1, p(·) → (· = x)} [x := f ]p(x) ↔ p(f ) Correct [x := x2][(z := x+z)∗; z := x+yz]y≥x ↔ [(z := x2+z∗); z := x2+yz]y≥x2 with σ = {f → x2, p(·) → [(z := · + z)∗; z := · + yz]y ≥ ·} p → [a]p Clash x ≥ 0 → [ BV x′ = −1]x ≥ 0 σ = {a → x′ = −1, p → x FV ≥ 0} (−x)2 ≥ 0 [x′ = −1](−x)2 ≥ 0 by p(¯ x) [a]p(¯ x) σ = {a → x′ = −1, p(·) → (−·)2 ≥ 0}

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 13 / 27

SLIDE 27

Uniform Substitution: Examples

[x := f ]p(x) ↔ p(f ) Clash [x := x + 1]x = x ↔ x + 1 = x σ = {f → x + 1, p(·) → (· = x)} [x := f ]p(x) ↔ p(f ) Correct [x := x2][(z := x+z)∗; z := x+yz]y≥x ↔ [(z := x2+z∗); z := x2+yz]y≥x2 with σ = {f → x2, p(·) → [(z := · + z)∗; z := · + yz]y ≥ ·} p → [a]p Clash x ≥ 0 → [x′ = −1]x ≥ 0 σ = {a → x′ = −1, p → x ≥ 0} (−x)2 ≥ 0 Correct [x′ = −1](−x)2 ≥ 0 by p(¯ x) [a]p(¯ x) σ = {a → x′ = −1, p(·) → (−·)2 ≥ 0}

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 13 / 27

SLIDE 28

Solving Differential Equations? By Axiom Schema?

[′] [x′ = θ]φ ↔ ∀t≥0 [x := x(t)]φ (t fresh and x′(t) = θ) Axiom schema with side conditions:

1 Occurs check: t fresh 2 Solution check: x solves the ODE x′(t) = θ 3 Initial value check: x solves the symbolic IVP x(0) = x

Quite nontrivial soundness-critical algorithms . . . LICS’12

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 14 / 27

SLIDE 29

Differential Equation Axioms & Differential Axioms

DW [x′ = f (x) & q(x)]q(x) DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

DE [x′ = f (x) & q(x)]p(x, x′) ↔ [x′ = f (x) & q(x)][x′ := f (x)]p(x, x′) DI [x′ = f (x) & q(x)]p(x) ←

q(x) → p(x) ∧ [x′ = f (x) & q(x)](p(x))′

DG [x′ = f (x) & q(x)]p(x) ↔ ∃y [x′ = f (x), y′ = a(x)y + b(x) & q(x)]p(x) DS [x′ = f & q(x)]p(x) ↔ ∀t≥0

(∀0≤s≤t q(x + fs)) → [x := x + ft]p(x)
[′:=] [x′ := f ]p(x′) ↔ p(f )

+′ (f (¯ x) + g(¯ x))′ = (f (¯ x))′ + (g(¯ x))′ ·′ (f (¯ x) · g(¯ x))′ = (f (¯ x))′ · g(¯ x) + f (¯ x) · (g(¯ x))′

′ [y := g(x)][y′ := 1]
(f (g(x)))′ = (f (y))′ · (g(x))′

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 15 / 27

SLIDE 30

Differential Equation Axioms

Axiom (Differential Weakening)

DW [x′ = f (x) & q(x)]q(x) t x q(x) w u r x′ = f (x) & q(x) ¬q(x) Differential equations cannot leave their evolution domains. Implies: [x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)]

q(x) → p(x)
Andr´

e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 16 / 27

SLIDE 31

Differential Equation Axioms

Axiom (Differential Cut)

DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

t x q(x) w u r x′ = f (x) & q(x) w q(x) DC is a cut for differential equations. DC is a differential modal modus ponens K. Can’t leave r(x), then might as well restrict state space to r(x).

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 16 / 27

SLIDE 32

Differential Equation Axioms

Axiom (Differential Invariant)

DI [x′ = f (x) & q(x)]p(x) ←

q(x) → p(x) ∧ [x′ = f (x) & q(x)](p(x))′

t x q(x) w u r x′ = f (x) & q(x)

¬ ¬F

F F

Differential invariant: p(x) true now and its differential (p(x))′ true always What’s the differential of a formula??? What’s the meaning of a differential term . . . in a state???

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 16 / 27

SLIDE 33

Differential Equation Axioms

Axiom (Differential Effect)

DE [x′ = f (x) & q(x)]p(x, x′) ↔ [x′ = f (x) & q(x)][x′ := f (x)]p(x, x′) t x q(x) w u r x′ = f (x) & q(x) x′ f (x) Effect of differential equation on differential symbol x′ [x′ := f (x)] instantly mimics continuous effect [x′ = f (x)] on x′ [x′ := f (x)] selects vector field x′ = f (x) for subsequent differentials

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 16 / 27

SLIDE 34

Example: Differential Invariants Don’t Solve. Prove!

1 DI proves a property of an ODE inductively by its differentials 2 DE exports vector field, possibly after DW exports evolution domain 3 CE+CQ reason efficiently in Equivalence or eQuational context 4 G isolates postcondition 5 [′:=] differential substitution uses vector field 6 ·′ differential computations are axiomatic (US)

∗

R

x3·x + x·x3 ≥ 0

[′:=] [x′ := x3]x′·x + x·x′ ≥ 0 G

[x′ = x3][x′ := x3]x′·x+x·x′≥0 ∗

·′ (f (¯

x)·g(¯ x))′ = (f (¯ x))′·g(¯ x)+f (¯ x)·(g(¯ x))′

US

(x·x)′ = (x)′·x + x·(x)′ (x·x)′ = x′·x + x·x′

CQ

(x·x)′ ≥ 0 ↔ x′·x + x·x′ ≥ 0 (x·x ≥ 1)′ ↔ x′·x + x·x′ ≥ 0

CE

[x′ = x3][x′ := x3](x·x ≥ 1)′

DE

[x′ = x3](x·x ≥ 1)′

DI

x·x ≥ 1 →[x′ = x3]x·x ≥ 1

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 17 / 27

SLIDE 35

Example: Soundly Solving Differential Equations

1 DG introduces time t, DC cuts solution in, that DI proves and 2 DW exports to postcondition 3 inverse DC removes evolution domain constraints 4 inverse DG removes original ODE 5 DS solves remaining ODE for time

∗

R φ →∀s≥0 (x0 + a

2s2 + v0s ≥ 0) [:=]φ →∀s≥0 [t := 0 + 1s]x0 + a 2t2 + v0t ≥ 0 DSφ →[t′ = 1]x0 + a 2t2 + v0t ≥ 0 DGφ →[v ′ = a, t′ = 1]x0 + a 2t2 + v0t ≥ 0 DGφ →[x′ = v, v ′ = a, t′ = 1]x0 + a 2t2 + v0t ≥ 0 DCφ →[x′ = v, v ′ = a, t′ = 1 & v = v0 + at]x0 + a 2t2 + v0t ≥ 0 DCφ →[x′ = v, v ′ = a, t′ = 1 & v = v0 + at ∧ x = x0 + a 2t2 + v0t]x0 + a 2t2 + v0t ≥ 0 G,Kφ →[x′ = v, v ′ = a, t′ = 1 & v = v0 + at ∧ x = x0 + a 2t2 + v0t](x=x0+ a 2t2+v0t → x≥0) DWφ →[x′ = v, v ′ = a, t′ = 1 & v = v0 + at ∧ x = x0 + a 2t2 + v0t]x ≥ 0 DCφ →[x′ = v, v ′ = a, t′ = 1 & v = v0 + at]x ≥ 0 DCφ →[x′ = v, v ′ = a, t′ = 1]x ≥ 0

φ →∃t [x′ = v, v ′ = a, t′ = 1]x ≥ 0

DGφ →[x′ = v, v ′ = a]x ≥ 0 Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 18 / 27

SLIDE 36

Outline

1

Cyber-Physical Systems

2

Uniform Substitution Calculus for Differential Dynamic Logic Uniform Substitution Calculus Axiom vs. Axiom Schemata Uniform Substitutions Differential Axioms Examples

3

Differential-form Differential Dynamic Logic Semantics: Local Differential Substitution Lemmas Static Semantics

4

Summary

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 18 / 27

SLIDE 37

Differential Equation Axioms

Axiom (Differential Invariant)

DI [x′ = f (x) & q(x)]p(x) ←

q(x) → p(x) ∧ [x′ = f (x) & q(x)](p(x))′

t x q(x) w u r x′ = f (x) & q(x)

¬ ¬F

F F

Differential invariant: p(x) true now and its differential (p(x))′ true always What’s the differential of a formula??? What’s the meaning of a differential term . . . in a state???

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 19 / 27

SLIDE 38

The Meaning of Primes

[ [(θ)′] ]u = ??? [ [(x2)′] ]u

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 20 / 27

SLIDE 39

The Meaning of Primes

[ [(θ)′] ]u = ??? [ [(x2)′] ]u = [ [2x] ]u ?

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 20 / 27

SLIDE 40

The Meaning of Primes

[ [(θ)′] ]u = ??? [ [(x2)′] ]u = [ [2x] ]u ? depends on the differential equation . . .

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 20 / 27

SLIDE 41

The Meaning of Primes

[ [(θ)′] ]u = ??? [ [(x2)′] ]u = [ [2x] ]u ? depends on the differential equation . . . well-defined locally in an isolated state at all?

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 20 / 27

SLIDE 42

The Meaning of Primes Differential Forms

[ [(θ)′] ]u = ??? [ [(x2)′] ]u = [ [2x] ]u ? depends on the differential equation . . . well-defined locally in an isolated state at all? [ [(θ)′] ]u =

x

u(x′)∂[ [θ] ]I ∂x (u) =

x

u(x′)∂[ [θ] ]uX

x

∂X [ [(θ)′] ] = d[ [θ] ] =

n

i=1

∂[ [θ] ] ∂xi dxi depends on state u tangent space basis cotangent space basis depends on u(x′

i ) = dxi

→ R

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 20 / 27

SLIDE 43

The Meaning of Primes Differential Forms

[ [(θ)′] ]u = ??? [ [(x2)′] ]u = [ [2x] ]u ? depends on the differential equation . . . well-defined locally in an isolated state at all? [ [(θ)′] ]u =

x

u(x′)∂[ [θ] ]I ∂x (u) =

x

u(x′)∂[ [θ] ]uX

x

∂X [ [(θ)′] ] = d[ [θ] ] =

n

i=1

∂[ [θ] ] ∂xi dxi u(x′) is the local shadow of dx dt if that existed (θ)′ represents how θ changes locally, depending on x′ → R

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 20 / 27

SLIDE 44

Differential Substitution Lemmas

Lemma (Differential lemma)

If I, ϕ | = x′ = θ ∧ H for duration r > 0, then for all 0 ≤ ζ ≤ r: Syntactic [ [(η)′] ]Iϕ(ζ) = d[ [η] ]Iϕ(t) dt (ζ) Analytic

Lemma (Differential assignment)

If I, ϕ | = x′ = θ ∧ H then I, ϕ | = φ ↔ [x′ := θ]φ

Lemma (Derivations)

(θ + η)′ = (θ)′ + (η)′ (θ · η)′ = (θ)′ · η + θ · (η)′ [y := θ][y′ := 1]

(f (θ))′ = (f (y))′ · (θ)′

for y, y′ ∈ θ (f )′ = 0 for arity 0 functions/numbers f

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 22 / 27

SLIDE 45

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US φ σ(φ) provided FV(σ|Σ(θ)) ∩ BV(⊗(·)) = ∅ for each operation ⊗(θ) in φ i.e. bound variables U = BV(⊗(·)) of operator ⊗ are not free in the substitution on its argument θ (U-admissible) Uniform substitution σ replaces all occurrences of p(θ) for any θ by ψ(θ) function f (θ) for any θ by η(θ) quantifier C(φ) for any φ by ψ(θ) program const. a by α

US

[a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) [x := x + 1 ∪ x′ = 1]x ≥ 0 ↔ [x := x + 1]x ≥ 0 ∧ [x′ = 1]x ≥ 0

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 23 / 27

SLIDE 46

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US φ σ(φ) provided FV(σ|Σ(θ)) ∩ BV(⊗(·)) = ∅ for each operation ⊗(θ) in φ i.e. bound variables U = BV(⊗(·)) of operator ⊗ are not free in the substitution on its argument θ (U-admissible) Uniform substitution σ replaces all occurrences of p(θ) for any θ by ψ(θ) function f (θ) for any θ by η(θ) quantifier C(φ) for any φ by ψ(θ) program const. a by α Modular interface: Prover vs. Logic

US

[a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) [x := x + 1 ∪ x′ = 1]x ≥ 0 ↔ [x := x + 1]x ≥ 0 ∧ [x′ = 1]x ≥ 0

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 23 / 27

SLIDE 47

Correctness of Static Semantics

Lemma (Bound effect lemma) (Only BV(·) change)

If (u, w) ∈ [ [α] ]I, then u = w on BV(α)∁.

Lemma (Coincidence lemma) (Only FV(·) determine truth)

If u = ˜ u on FV(θ) and I = J on Σ(θ), then [ [θ] ]Iu = [ [θ] ]J ˜ u u ∈ [ [φ] ]I iff ˜ u ∈ [ [φ] ]J u w ˜ u ˜ w

n V ⊇ FV(α)

α α ∃

n V ∪ MBV(α)
n BV(α)∁
n BV(α)∁

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 24 / 27

SLIDE 48

Differential Dynamic Logic dL: Static Semantics

FV((θ)′) FV(p(θ1, . . . , θk)) FV(C(φ)) FV(φ ∧ ψ) FV(∀x φ) = FV(∃x φ) FV([α]φ) = FV(αφ) FV(a) FV(x := θ) = FV(x′ := θ) FV(?H) FV(x′ = θ & H) FV(α ∪ β) FV(α; β) FV(α∗)

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 25 / 27

SLIDE 49

Differential Dynamic Logic dL: Static Semantics

FV((θ)′) = FV(θ) FV(p(θ1, . . . , θk)) = FV(θ1) ∪ · · · ∪ FV(θk) FV(C(φ)) = V ∪ V′ FV(φ ∧ ψ) = FV(φ) ∪ FV(ψ) FV(∀x φ) = FV(∃x φ) = FV(φ) \ {x} FV([α]φ) = FV(αφ) = FV(α) ∪ (FV(φ) \ BV(α)) FV(a) = V ∪ V′ for program const. a FV(x := θ) = FV(x′ := θ) = FV(θ) FV(?H) = FV(H) FV(x′ = θ & H) = {x} ∪ FV(θ) ∪ FV(H) FV(α ∪ β) = FV(α) ∪ FV(β) FV(α; β) = FV(α) ∪ (FV(β) \ BV(α)) FV(α∗) = FV(α)

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 25 / 27

SLIDE 50

Differential Dynamic Logic dL: Static Semantics

FV((θ)′) = FV(θ) ∪ FV(θ)′ caution FV(p(θ1, . . . , θk)) = FV(θ1) ∪ · · · ∪ FV(θk) FV(C(φ)) = V ∪ V′ FV(φ ∧ ψ) = FV(φ) ∪ FV(ψ) FV(∀x φ) = FV(∃x φ) = FV(φ) \ {x} FV([α]φ) = FV(αφ) = FV(α) ∪ (FV(φ) \ MBV(α)) caution FV(a) = V ∪ V′ for program const. a FV(x := θ) = FV(x′ := θ) = FV(θ) FV(?H) = FV(H) FV(x′ = θ & H) = {x} ∪ FV(θ) ∪ FV(H) FV(α ∪ β) = FV(α) ∪ FV(β) FV(α; β) = FV(α) ∪ (FV(β) \ MBV(α)) caution FV(α∗) = FV(α)

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 25 / 27

SLIDE 51

Outline

1

Cyber-Physical Systems

2

Uniform Substitution Calculus for Differential Dynamic Logic Uniform Substitution Calculus Axiom vs. Axiom Schemata Uniform Substitutions Differential Axioms Examples

3

Differential-form Differential Dynamic Logic Semantics: Local Differential Substitution Lemmas Static Semantics

4

Summary

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 25 / 27

SLIDE 52

Uniform Substitution for Differential Dynamic Logic

differential dynamic logic

dL = DL + HP [α]φ φ α Differential forms local axioms of ODEs Uniform substitution modular generic axioms (not schemata) Modular: Logic Prover Straightforward to implement Tactics regain efficiency Fast contextual equivalence KeYmaera X

d i s c r e t e c

n

t i n u

u

s nondet stochastic a d v e r s a r i a l

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 26 / 27

SLIDE 53

Key Contributions

Q: How to build a prover with a small soundness-critical core? A: Uniform substitution [Church] Q: How to enable flexible yet sound reasoning? A: Axioms with local meaning [Philosophy, Algebraic Geometry] Q: What’s the local meaning of a differential equation? A: Differential forms [Differential Geometry] Q: How to do hybrid systems proving? A: Uniform substitution calculus for differential dynamic logic Q: What’s the impact of uniform substitution on a prover core? A: 65 989 ց 1 682 LOC (2.5%) [KeYmaera X]

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 27 / 27

SLIDE 54

Logical Foundations

f

Cyber-Physical Systems

Logic

Theorem Proving Proof Theory Modal Logic Model Checking

Algebra

Computer Algebra R Algebraic Geometry Differential Algebra Lie Algebra

Analysis

Differential Equations Carath´ edory Solutions Viscosity PDE Solutions Dynamical Systems

Stochastics

Doob’s Super- martingales Dynkin’s Infinitesimal Generators Differential Generators Stochastic Differential Equations

Numerics

Hermite Interpolation Weierstraß Approx- imation Error Analysis Numerical Integration

Algorithms

Decision Procedures Proof Search Procedures Fixpoints & Lattices Closure Ordinals

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 1 / 6

SLIDE 55

KeYmaera X Kernel: Qualifies as a Microkernel

≈LOC KeYmaera X 1 682 KeYmaera 65 989 KeY 51 328 HOL Light 396 Isabelle/Pure 8 113 Nuprl 15 000 + 50 000 Coq 20 000 HSolver 20 000 Flow∗ 25 000 PHAVer 30 000 dReal 50 000 + millions SpaceEx 100 000 HyCreate2 6 081 + user model analysis

Disclaimer: These self-reported estimates of the soundness-critical lines of code + rules are to be taken with a grain of salt. Different languages, capabilities, styles . . .

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 2 / 6

SLIDE 56

Andr´ e Platzer. A uniform substitution calculus for differential dynamic logic. In Amy Felty and Aart Middeldorp, editors, CADE, volume 9195 of LNCS, pages 467–481. Springer, 2015. doi:10.1007/978-3-319-21401-6_32. Andr´ e Platzer. The complete proof theory of hybrid systems. In LICS, pages 541–550. IEEE, 2012. doi:10.1109/LICS.2012.64. Andr´ e Platzer. Differential game logic. ACM Trans. Comput. Log. To appear. Preprint at arXiv 1408.1980.

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 3 / 6

SLIDE 57

Differential Dynamic Logic: Axioms

[:=] [x := f ]p(x) ↔ p(f ) [?] [?q]p ↔ (q → p) [∪] [a ∪ b]p(¯ x) ↔ [a]p(¯ x) ∧ [b]p(¯ x) [;] [a; b]p(¯ x) ↔ [a][b]p(¯ x) [∗] [a∗]p(¯ x) ↔ p(¯ x) ∧ [a][a∗]p(¯ x) K [a](p(¯ x) → q(¯ x)) → ([a]p(¯ x) → [a]q(¯ x)) I [a∗](p(¯ x) → [a]p(¯ x)) → (p(¯ x) → [a∗]p(¯ x)) V p → [a]p CADE’15

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 3 / 6

SLIDE 58

Differential Dynamic Logic: Axioms

G p(¯ x) [a]p(¯ x) ∀ p(x) ∀x p(x) MP p → q p q CT f (¯ x) = g(¯ x) c(f (¯ x)) = c(g(¯ x)) CQ f (¯ x) = g(¯ x) p(f (¯ x)) ↔ p(g(¯ x)) CE p(¯ x) ↔ q(¯ x) C(p(¯ x)) ↔ C(q(¯ x)) CADE’15

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 3 / 6

SLIDE 59

Differential Equation Axioms & Differential Axioms

DW [x′ = f (x) & q(x)]q(x) DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

DE [x′ = f (x) & q(x)]p(x, x′) ↔ [x′ = f (x) & q(x)][x′ := f (x)]p(x, x′) DI [x′ = f (x) & q(x)]p(x) ←

q(x) → p(x) ∧ [x′ = f (x) & q(x)](p(x))′

DG [x′ = f (x) & q(x)]p(x) ↔ ∃y [x′ = f (x), y′ = a(x)y + b(x) & q(x)]p(x) DS [x′ = f & q(x)]p(x) ↔ ∀t≥0

(∀0≤s≤t q(x + fs)) → [x := x + ft]p(x)
[′:=] [x′ := f ]p(x′) ↔ p(f )

+′ (f (¯ x) + g(¯ x))′ = (f (¯ x))′ + (g(¯ x))′ ·′ (f (¯ x) · g(¯ x))′ = (f (¯ x))′ · g(¯ x) + f (¯ x) · (g(¯ x))′

′ [y := g(x)][y′ := 1]
(f (g(x)))′ = (f (y))′ · (g(x))′

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 4 / 6

SLIDE 60

Differential Equation Axioms

Axiom (Differential Weakening)

DW [x′ = f (x) & q(x)]q(x) t x q(x) w u r x′ = f (x) & q(x) ¬q(x) Differential equations cannot leave their evolution domains. Implies: [x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)]

q(x) → p(x)
Andr´

e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 61

Differential Equation Axioms

Axiom (Differential Cut)

DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

t x q(x) w u r x′ = f (x) & q(x) DC is a cut for differential equations. DC is a differential modal modus ponens K. Can’t leave r(x), then might as well restrict state space to r(x).

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 62

Differential Equation Axioms

Axiom (Differential Cut)

DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

t x q(x) w u r x′ = f (x) & q(x) w q(x) DC is a cut for differential equations. DC is a differential modal modus ponens K. Can’t leave r(x), then might as well restrict state space to r(x).

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 63

Differential Equation Axioms

Axiom (Differential Cut)

DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

t x q(x) w u r x′ = f (x) & q(x) w DC is a cut for differential equations. DC is a differential modal modus ponens K. Can’t leave r(x), then might as well restrict state space to r(x).

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 64

Differential Equation Axioms

Axiom (Differential Cut)

DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

t x q(x) w u r x′ = f (x) & q(x) w DC is a cut for differential equations. DC is a differential modal modus ponens K. Can’t leave r(x), then might as well restrict state space to r(x).

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 65

Differential Equation Axioms

Axiom (Differential Cut)

DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

t x q(x) w u r x′ = f (x) & q(x) DC is a cut for differential equations. DC is a differential modal modus ponens K. Can’t leave r(x), then might as well restrict state space to r(x).

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 66

Differential Equation Axioms

Axiom (Differential Cut)

DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

t x q(x) w u r x′ = f (x) & q(x) w DC is a cut for differential equations. DC is a differential modal modus ponens K. Can’t leave r(x), then might as well restrict state space to r(x).

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 67

Differential Equation Axioms

Axiom (Differential Cut)

DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

t x q(x) w u r x′ = f (x) & q(x) w DC is a cut for differential equations. DC is a differential modal modus ponens K. Can’t leave r(x), then might as well restrict state space to r(x).

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 68

Differential Equation Axioms

Axiom (Differential Cut)

DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

t x q(x) w u r x′ = f (x) & q(x) w DC is a cut for differential equations. DC is a differential modal modus ponens K. Can’t leave r(x), then might as well restrict state space to r(x).

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 69

Differential Equation Axioms

Axiom (Differential Cut)

DC

[x′ = f (x) & q(x)]p(x) ↔ [x′ = f (x) & q(x)∧r(x)]p(x)
← [x′ = f (x) & q(x)]r(x)

t x q(x) w u r x′ = f (x) & q(x) w DC is a cut for differential equations. DC is a differential modal modus ponens K. Can’t leave r(x), then might as well restrict state space to r(x).

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 70

Differential Equation Axioms

Axiom (Differential Invariant)

DI [x′ = f (x) & q(x)]p(x) ←

q(x) → p(x) ∧ [x′ = f (x) & q(x)](p(x))′

t x q(x) w u r x′ = f (x) & q(x)

¬ ¬F

F F

Differential invariant: p(x) true now and its differential (p(x))′ true always What’s the differential of a formula??? What’s the meaning of a differential term . . . in a state???

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 71

Differential Equation Axioms

Axiom (Differential Effect)

DE [x′ = f (x) & q(x)]p(x, x′) ↔ [x′ = f (x) & q(x)][x′ := f (x)]p(x, x′) t x q(x) w u r x′ = f (x) & q(x) x′ f (x) Effect of differential equation on differential symbol x′ [x′ := f (x)] instantly mimics continuous effect [x′ = f (x)] on x′ [x′ := f (x)] selects vector field x′ = f (x) for subsequent differentials

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 72

Differential Equation Axioms

Axiom (Differential Ghost)

DG [x′ = f (x) & q(x)]p(x) ↔ ∃y [x′ = f (x), y′ = a(x)y + b(x) & q(x)]p(x) t x q(x) w u r x′ = f (x) & q(x) y′ = a(x)y + b(x) Differential ghost/auxiliaries: extra differential equations that exist Can cause new invariants “Dark matter” counterweight to balance conserved quantities

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 73

Differential Equation Axioms

Axiom (Differential Solution)

DS [x′ = f & q(x)]p(x) ↔ ∀t≥0

(∀0≤s≤t q(x+fs)) → [x := x + ft]p(x)
t

x q(x) w u r x′ = f (x) & q(x) t x q(x) u w r x′ = f & q(x) Differential solutions: solve differential equations with DG,DC and inverse companions

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 5 / 6

SLIDE 74

Differential-form Differential Dynamic Logic: Semantics

Definition (Term semantics) ([ [·] ] : Trm → (S → R))

[ [(θ)′] ]Iu =

x

u(x′)∂[ [θ] ]I ∂x (u) =

x

u(x′)∂[ [θ] ]IuX

x

∂X

Definition (dL semantics) ([ [·] ] : Fml → ℘(S))

[ [C(φ)] ]I = I(C)

[

[φ] ]I [ [αφ] ]I = [ [α] ]I ◦ [ [φ] ]I [ [[α]φ] ]I = [ [¬α¬φ] ]I

Definition (Program semantics) ([ [·] ] : HP → ℘(S × S))

[ [x′ = θ & H] ]I = {(ϕ(0)|{x′}∁, ϕ(r)) : I, ϕ | = x′ = θ ∧ H} [ [α ∪ β] ]I = [ [α] ]I ∪ [ [β] ]I [ [α; β] ]I = [ [α] ]I ◦ [ [β] ]I [ [α∗] ]I =

[

[α] ]I∗ =

n∈N

[ [αn] ]I

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 6 / 6

SLIDE 75

Differential-form Differential Dynamic Logic: Semantics

Definition (Term semantics) ([ [·] ] : Trm → (S → R))

[ [x] ]Iu = u(x) for variable x ∈ V [ [x′] ]Iu = u(x′) for differential symbol x′ ∈ V′ [ [f (θ1, . . . , θk)] ]Iu = I(f )

[

[θ1] ]Iu, . . . , [ [θk] ]Iu

for function symbol f

[ [θ + η] ]Iu = [ [θ] ]Iu + [ [η] ]Iu [ [θ · η] ]Iu = [ [θ] ]Iu · [ [η] ]Iu [ [(θ)′] ]Iu =

x

u(x′)∂[ [θ] ]I ∂x (u) =

x

u(x′)∂[ [θ] ]IuX

x

∂X

Definition (dL semantics) ([ [·] ] : Fml → ℘(S))

[ [C(φ)] ]I = I(C)

[

[φ] ]I [ [αφ] ]I = [ [α] ]I ◦ [ [φ] ]I [ [[α]φ] ]I = [ [¬α¬φ] ]I

Definition (Program semantics) ([ [·] ] : HP → ℘(S × S))

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 6 / 6

SLIDE 76

Differential-form Differential Dynamic Logic: Semantics

Definition (Term semantics) ([ [·] ] : Trm → (S → R))

[ [(θ)′] ]Iu =

x

u(x′)∂[ [θ] ]I ∂x (u) =

x

u(x′)∂[ [θ] ]IuX

x

∂X

Definition (dL semantics) ([ [·] ] : Fml → ℘(S))

[ [θ ≥ η] ]I = {u : [ [θ] ]Iu ≥ [ [η] ]Iu} [ [p(θ1, . . . , θk)] ]I = {u : ([ [θ1] ]Iu, . . . , [ [θk] ]Iu) ∈ I(p)} [ [C(φ)] ]I = I(C)

[

[φ] ]I [ [¬φ] ]I = ([ [φ] ]I)∁ [ [φ ∧ ψ] ]I = [ [φ] ]I ∩ [ [ψ] ]I [ [∃x φ] ]I = {u ∈ S : ur

x ∈ [

[φ] ]I for some r ∈ R} [ [αφ] ]I = [ [α] ]I ◦ [ [φ] ]I = {u : w ∈ [ [φ] ]I for some w (u, w) ∈ [ [α] ]I} [ [[α]φ] ]I = [ [¬α¬φ] ]I = {u : w ∈ [ [φ] ]I for all w (u, w) ∈ [ [α] ]I}

Definition (Program semantics) ([ [·] ] : HP → ℘(S × S))

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 6 / 6

SLIDE 77

Differential-form Differential Dynamic Logic: Semantics

Definition (Term semantics) ([ [·] ] : Trm → (S → R))

[ [(θ)′] ]Iu =

x

u(x′)∂[ [θ] ]I ∂x (u) =

x

u(x′)∂[ [θ] ]IuX

x

∂X

Definition (dL semantics) ([ [·] ] : Fml → ℘(S))

[ [C(φ)] ]I = I(C)

[

[φ] ]I [ [αφ] ]I = [ [α] ]I ◦ [ [φ] ]I [ [[α]φ] ]I = [ [¬α¬φ] ]I

Definition (Program semantics) ([ [·] ] : HP → ℘(S × S))

[ [a] ]I = I(a) [ [x := θ] ]I = {(u, w) : w = u except [ [x] ]Iw = [ [θ] ]Iu} [ [x′ := θ] ]I = {(u, w) : w = u except [ [x′] ]Iw = [ [θ] ]Iu} [ [?H] ]I = {(u, u) : u ∈ [ [H] ]I} [ [x′ = θ & H] ]I = {(ϕ(0)|{x′}∁, ϕ(r)) : I, ϕ | = x′ = θ ∧ H} [ [α ∪ β] ]I = [ [α] ]I ∪ [ [β] ]I

Andr´ e Platzer (CMU) Uniform Substitution for Differential Dynamic Logic CADE 6 / 6