An Axiomatic Approach to Liveness for Differential Equations Yong - PowerPoint PPT Presentation

An Axiomatic Approach to Liveness for Differential Equations Yong Kiam Tan Andr´ e Platzer Computer Science Department, Carnegie Mellon University FM, 10th Oct 2019 1

Outline Motivation 1 Logical Approach to ODE Liveness 2 Concrete Example 3 More ODE Liveness Arguments 4 2

Outline Motivation 1 Logical Approach to ODE Liveness 2 Concrete Example 3 More ODE Liveness Arguments 4 3

Motivation : Cyber-Physical Systems (CPSs) Hybrid system models enable formal analysis of safety-critical CPSs: Discrete control: if (v > speed_limit) a := -1; //apply brakes else a := 0; //cruise 4

Motivation : Cyber-Physical Systems (CPSs) Hybrid system models enable formal analysis of safety-critical CPSs: Discrete control: if (v > speed_limit) a := -1; //apply brakes else a := 0; //cruise Continuous dynamics: x ′ = v , v ′ = a � �� � Ordinary Differential Equations (ODEs) 4

Motivation : Cyber-Physical Systems (CPSs) Hybrid system models enable formal analysis of safety-critical CPSs: Discrete control: if (v > speed_limit) a := -1; //apply brakes else a := 0; //cruise Continuous dynamics: x ′ = v , v ′ = a � �� � ODEs need proofs too! 4

Correctness Specifications for CPSs � Safely under speed limit 5

Correctness Specifications for CPSs � Safely under speed limit � Safely under speed limit 5

Correctness Specifications for CPSs � Safely under speed limit � Gets to destination System is safe and live � Safely under speed limit × Not moving at all! System is safe but not live 5

ODEs and Domain Constraints Ordinary Differential Equation (ODE) � �� � x ′ = f ( x ) ODE : Models continuous physics of the system x' = f ( x ) Trains drive on tracks prescribed by the ODEs. 6

ODEs and Domain Constraints ODE with domain Q � �� � x ′ = f ( x ) & Q Domain : Specifies the domain of definition for ODEs x' = f ( x ) Q There are no train tracks across the national park! 6

⨯⨯ ⨯ ✓ Safety & Liveness for ODEs ODE with domain Q � �� � x ′ = f ( x ) & Q ] P Safety: [ ���� Safe region ✓ ⨯ ✓ P ✓ Q � Trains stay in Porto ( P ) while driving on tracks. 7

Safety & Liveness for ODEs ODE with domain Q ODE with domain Q � �� � � �� � x ′ = f ( x ) & Q ] P x ′ = f ( x ) & Q � P Safety: [ Liveness: � ���� ���� Safe region ⨯⨯ Goal region ✓ ⨯ ⨯ ✓ P P ✓ ✓ Q Q � Trains stay in Porto ( P ) while � Trains reach Porto ( P ) by driving driving on tracks. on tracks. 7

Safety & Liveness for ODEs ODE with domain Q ODE with domain Q � �� � � �� � x ′ = f ( x ) & Q ] P x ′ = f ( x ) & Q � P Safety: [ Liveness: � ���� ���� Safe region ⨯⨯ Goal region ✓ ⨯ ⨯ ✓ P P ✓ ✓ Q Q Prior work: complete invariance � Trains reach Porto ( P ) by driving proofs for ODE safety [LICS’18] on tracks. 7

Safety & Liveness for ODEs ODE with domain Q ODE with domain Q � �� � � �� � x ′ = f ( x ) & Q ] P x ′ = f ( x ) & Q � P Safety: [ Liveness: � ���� ���� Safe region ⨯⨯ Goal region ✓ ⨯ ⨯ ✓ P P ✓ ✓ Q Q Prior work: complete invariance This talk: proving ODE liveness in proofs for ODE safety [LICS’18] differential dynamic logic (dL) 7

An Axiomatic Approach to Liveness for ODEs Why take a logical approach? Surveyed Liveness Arguments Goals of surveyed paper Differential Variants [1] Liveness proofs for inequalities Bounded/Compact Eventuality [3, 4] Automatic SOS liveness proofs Set Lyapunov Functions [5] Finding basin of attraction Staging Sets + Progress [6] Indirect liveness proofs for P Eq. Differential Variants [7] Synthesizing switching logic Liveness arguments in the literature are used for a wide variety of purposes. 8

An Axiomatic Approach to Liveness for ODEs Why take a logical approach? Surveyed Liveness Arguments Without Domains With Domains Differential Variants [1] × Bounded/Compact Eventuality [3, 4] × × Set Lyapunov Functions [5] × × Staging Sets + Progress [6] Eq. Differential Variants [7] × × Several arguments have technical glitches, making them unsound ( × ). 8

An Axiomatic Approach to Liveness for ODEs Why take a logical approach? Surveyed Liveness Arguments Without Domains With Domains � × � � Differential Variants [1] × � � × � � Bounded/Compact Eventuality [3, 4] Set Lyapunov Functions [5] × � � × � � Staging Sets + Progress [6] � � Eq. Differential Variants [7] × � � × � � Our approach formalizes the underlying liveness arguments in a sound ( � ), foundational, and uniform framework. It also corrects ( × � � ) the technical glitches. 8

An Axiomatic Approach to Liveness for ODEs Why take a logical approach? Understand the core principles behind ODE liveness proofs. Surveyed Liveness Arguments Without Domains With Domains � × � � Differential Variants [1] × � � × � � Bounded/Compact Eventuality [3, 4] Set Lyapunov Functions [5] × � � × � � Staging Sets + Progress [6] � � Eq. Differential Variants [7] × � � × � � 8

An Axiomatic Approach to Liveness for ODEs Why take a logical approach? Understand the core principles behind ODE liveness proofs. Surveyed Liveness Arguments Without Domains With Domains � × � � Differential Variants [1] × � � × � � Bounded/Compact Eventuality [3, 4] Set Lyapunov Functions [5] × � � × � � Staging Sets + Progress [6] � � Eq. Differential Variants [7] × � � × � � Yields generalizations of existing liveness arguments “for free”. New Liveness Arguments Without Domains With Domains - Higher Differential Variants � - [1] + [3, 4] + [6] � - [1] + [3, 4] + [6] + Higher Diff. Var. � 8

Outline Motivation 1 Logical Approach to ODE Liveness 2 Concrete Example 3 More ODE Liveness Arguments 4 9

A Simple Liveness Refinement Portugal Porto Trains that reach Porto also reach Portugal since Porto is part of Portugal. � x ′ = f ( x ) � Porto → � x ′ = f ( x ) � Portugal � 10

A Simple Liveness Refinement Portugal Porto Braga Can train reach Porto if it reaches Braga? Not true for all trains. � x ′ = f ( x ) � Braga → � x ′ = f ( x ) � Porto ? 10

A Simple Liveness Refinement Portugal Porto Braga Must use specific properties of the ODE / train track. [ x ′ = f ( x ) & ¬ Porto ] ¬ Braga → � � x ′ = f ( x ) � Braga → � x ′ = f ( x ) � Porto � 10

A Simple Liveness Refinement Portugal Porto Braga Must use specific properties of the ODE / train track. [ x ′ = f ( x ) & ¬ Porto ] ¬ Braga → � � x ′ = f ( x ) � Braga → � x ′ = f ( x ) � Porto � � �� � � �� � Known liveness property Desired liveness property 10

A Simple Liveness Refinement Portugal Porto Braga Must use specific properties of the ODE / train track. [ x ′ = f ( x ) & ¬ Porto ] ¬ Braga � � x ′ = f ( x ) � Braga → � x ′ = f ( x ) � Porto � → � �� � � �� � � �� � Need to show Known liveness property Desired liveness property 10

A Simple Liveness Refinement Portugal Porto Braga Key Idea: Liveness arguments can and should be understood using liveness refinement steps. [ x ′ = f ( x ) & ¬ Porto ] ¬ Braga � � x ′ = f ( x ) � Braga → � x ′ = f ( x ) � Porto � → � �� � � �� � � �� � Need to show Known liveness property Desired liveness property 10

⋀ Diamond Refinement Axioms [ x ′ = f ( x ) & ¬ Porto ] ¬ Braga � � x ′ = f ( x ) � Braga → � x ′ = f ( x ) � Porto � → � �� � � �� � � �� � Need to show Known liveness property Desired liveness property 11

⋀ Diamond Refinement Axioms [ x ′ = f ( x ) & ¬ P ] ¬ B → � � x ′ = f ( x ) � B →� x ′ = f ( x ) � P � 11

⋀ Diamond Refinement Axioms � � K � & � [ x ′ = f ( x ) & Q ∧ ¬ P ] ¬ B → � x ′ = f ( x ) & Q � B → � x ′ = f ( x ) & Q � P → B P B Q Q � �� � � �� � Known liveness property Desired liveness property 11

Diamond Refinement Axioms � � K � & � [ x ′ = f ( x ) & Q ∧ ¬ P ] ¬ B → � x ′ = f ( x ) & Q � B → � x ′ = f ( x ) & Q � P → → B B P B Q ⋀ ¬ P Q Q � �� � � �� � � �� � Need to show Known liveness property Desired liveness property 11

Diamond Refinement Axioms � � K � & � [ x ′ = f ( x ) & Q ∧ ¬ P ] ¬ B → � x ′ = f ( x ) & Q � B → � x ′ = f ( x ) & Q � P DR �·� [ x ′ = f ( x ) & R ] Q → � � x ′ = f ( x ) & R � P → � x ′ = f ( x ) & Q � P � R R R → → P P Q Q � �� � � �� � � �� � Need to show Known liveness property Desired liveness property 12