CoasterX: A Case Study in Component-Driven Hybrid Systems Proof Automation Based on ADHS ’18 [BLCP18] Brandon Bohrer (joint work with Adriel Luo, Xuean Chuang, Andr´ e Platzer) Logical Systems Lab Computer Science Department Carnegie Mellon University Speaking Skills, Mar 26 2018 1 / 49
Outline 1 Motivation 2 Approach 3 Modeling and Verification Background: d L Identifying Assumptions Formal Specification Formal Verification 4 Evaluation 5 Future Work and Conclusion 2 / 49
Roller Coasters are Safety-Critical Systems Top Thrill Steel Phantom Mindbender [BLCP18] Joker’s Jinx Phantom’s Revenge Fujin Raijin II Rollback Head Injury Derailment 3 / 49
Formal Proofs in d L Ensure Safe Designs [BLCP18] Top Thrill Steel Phantom Mindbender Rollback Head Injury Derailment ⇓ Pre → [ phys ] Post Identify: • Notion of safety Post ( acc < acc hi ) 4 / 49
Formal Proofs in d L Ensure Safe Designs [BLCP18] Top Thrill Steel Phantom Mindbender Rollback Head Injury Derailment ⇓ Pre → [ phys ] Post Identify: • Notion of safety Post ( acc < acc hi ) • Safe conditions Pre ( v = v 0 ) 4 / 49
Formal Proofs in d L Ensure Safe Designs [BLCP18] Top Thrill Steel Phantom Mindbender Rollback Head Injury Derailment ⇓ Pre → [ phys ] Post Identify: • Notion of safety Post ( acc < acc hi ) • Safe conditions Pre ( v = v 0 ) Verify physical environment design phys ( { x ′ = . . . , y ′ = . . . } ) 4 / 49
Design Verification Supplements Simulation Simulations typically used today [XXLY12, Wei15] Approach Pro Con Simulate Rich dynamics, easy Low rigor+precision Verify High rigor+precision Simple dynamics, hard 5 / 49
Verifying Physical Designs is a Challenge • How do we verify models at scale? • How do we make verification accessible to non-experts? 6 / 49
Verifying Environment Designs is Important ⇓ 7 / 49
Outline 1 Motivation 2 Approach 3 Modeling and Verification Background: d L Identifying Assumptions Formal Specification Formal Verification 4 Evaluation 5 Future Work and Conclusion 8 / 49
Component-Driven Proof Automation Enables Design Verification KeYmaera X Prover Core d L fml. GUI Builder (1700 Lines) CoasterX [FMQ + 15] Backend Component d L pf. model Goal Solution Accessible High-level graphical modeling 9 / 49
Component-Driven Proof Automation Enables Design Verification KeYmaera X Prover Core d L fml. GUI Builder (1700 Lines) CoasterX [FMQ + 15] Backend Component d L pf. model Goal Solution Accessible High-level graphical modeling Rigorous Formal proof checked by small prover core 9 / 49
Component-Driven Proof Automation Enables Design Verification KeYmaera X Prover Core d L fml. GUI Builder (1700 Lines) CoasterX [FMQ + 15] Backend Component d L pf. model Goal Solution Accessible High-level graphical modeling Rigorous Formal proof checked by small prover core Scalable Proof scales by exploiting component structure 9 / 49
Track Sections are Components for Coasters Generic Component 10 / 49
Track Sections are Components for Coasters Generic Component � � � Automatic Composition 10 / 49
Track Sections are Components for Coasters Generic Component � � � Automatic Composition 11 / 49
Track Sections are Components for Coasters Generic Component � � � Automatic Composition 12 / 49
Track Sections are Components for Coasters Generic Component � � � Automatic Composition 13 / 49
Track Sections are Components for Coasters Generic Component � � � Automatic Composition 14 / 49
Outline 1 Motivation 2 Approach 3 Modeling and Verification Background: d L Identifying Assumptions Formal Specification Formal Verification 4 Evaluation 5 Future Work and Conclusion 15 / 49
Outline 1 Motivation 2 Approach 3 Modeling and Verification Background: d L Identifying Assumptions Formal Specification Formal Verification 4 Evaluation 5 Future Work and Conclusion 16 / 49
Background: d L Formulas P , Q ::= P ∧ Q | ¬ P | ∀ xP | ∃ xP | θ 1 ≥ θ 2 | [ α ] P | � α � P Example: Pre → [ phys ] Post Construct Meaning P ∧ Q , ¬ P Classical propositional connectives 17 / 49
Background: d L Formulas P , Q ::= P ∧ Q | ¬ P | ∀ xP | ∃ xP | θ 1 ≥ θ 2 | [ α ] P | � α � P Example: Pre → [ phys ] Post Construct Meaning P ∧ Q , ¬ P Classical propositional connectives ∀ x P , ∃ x P First-order real quantifiers θ 1 ≥ θ 2 Real arithmetic comparisons 17 / 49
Background: d L Formulas P , Q ::= P ∧ Q | ¬ P | ∀ xP | ∃ xP | θ 1 ≥ θ 2 | [ α ] P | � α � P Example: Pre → [ phys ] Post Construct Meaning P ∧ Q , ¬ P Classical propositional connectives ∀ x P , ∃ x P First-order real quantifiers θ 1 ≥ θ 2 Real arithmetic comparisons [ α ] P After α runs, P always holds � α � P After α runs, P sometimes holds 17 / 49
Background: Hybrid Programs α, β ::= ? P | x := θ | { x ′ = θ & P } | α ∪ β | α ; β | α ∗ Construct Meaning ? P Assert formula P , else fail 18 / 49
Background: Hybrid Programs α, β ::= ? P | x := θ | { x ′ = θ & P } | α ∪ β | α ; β | α ∗ Construct Meaning ? P Assert formula P , else fail x := θ Assign value of term θ to x 18 / 49
Background: Hybrid Programs α, β ::= ? P | x := θ | { x ′ = θ & P } | α ∪ β | α ; β | α ∗ Construct Meaning ? P Assert formula P , else fail x := θ Assign value of term θ to x { x ′ = θ & P } Evolve x at continuous rate θ 18 / 49
Background: Hybrid Programs α, β ::= ? P | x := θ | { x ′ = θ & P } | α ∪ β | α ; β | α ∗ Construct Meaning ? P Assert formula P , else fail x := θ Assign value of term θ to x { x ′ = θ & P } Evolve x at continuous rate θ Evolution domain constraint P asserted continuously 18 / 49
Background: Hybrid Programs α, β ::= ? P | x := θ | { x ′ = θ & P } | α ∪ β | α ; β | α ∗ Construct Meaning ? P Assert formula P , else fail x := θ Assign value of term θ to x { x ′ = θ & P } Evolve x at continuous rate θ Evolution domain constraint P asserted continuously P must also hold initially (like ? P ) 18 / 49
Background: Hybrid Programs α, β ::= ? P | x := θ | { x ′ = θ & P } | α ∪ β | α ; β | α ∗ Construct Meaning ? P Assert formula P , else fail x := θ Assign value of term θ to x { x ′ = θ & P } Evolve x at continuous rate θ Evolution domain constraint P asserted continuously P must also hold initially (like ? P ) α ∪ β Choose either α or β nondeterministically 18 / 49
Background: Hybrid Programs α, β ::= ? P | x := θ | { x ′ = θ & P } | α ∪ β | α ; β | α ∗ Construct Meaning ? P Assert formula P , else fail x := θ Assign value of term θ to x { x ′ = θ & P } Evolve x at continuous rate θ Evolution domain constraint P asserted continuously P must also hold initially (like ? P ) α ∪ β Choose either α or β nondeterministically α ; β First α then β in any resulting state 18 / 49
Background: Hybrid Programs α, β ::= ? P | x := θ | { x ′ = θ & P } | α ∪ β | α ; β | α ∗ Construct Meaning ? P Assert formula P , else fail x := θ Assign value of term θ to x { x ′ = θ & P } Evolve x at continuous rate θ Evolution domain constraint P asserted continuously P must also hold initially (like ? P ) α ∪ β Choose either α or β nondeterministically α ; β First α then β in any resulting state α ∗ Loop α nondeterministically n ≥ 0 times 18 / 49
Outline 1 Motivation 2 Approach 3 Modeling and Verification Background: d L Identifying Assumptions Formal Specification Formal Verification 4 Evaluation 5 Future Work and Conclusion 19 / 49
Velocity and Acceleration Bounds are Fundamental Rollback Head Injury Derailment 0 < v lo ≤ v | a | ≤ a hi | a | ≤ a hi [AST17] 20 / 49
Tracks are 2D • 2D modeling greatly simplifies GUI • Vertical and horizontal bounds only (no lateral bound) • Ignores banking, wind, roll resistance (1-2%) ⇒ 21 / 49
Acceleration Bound is Conservative Top Thrill Steel Phantom Mindbender Joker’s Jinx Phantom’s Revenge Fujin Raijin II Rollback Head Injury Derailment ( > ) ( < ) ( < ) 22 / 49
Conservative Bound Suffices for Phantom Top Thrill Steel Phantom Mindbender Joker’s Jinx Phantom’s Revenge Fujin Raijin II Rollback Head Injury Derailment ( > ) ( < ) ( < ) 23 / 49
Outline 1 Motivation 2 Approach 3 Modeling and Verification Background: d L Identifying Assumptions Formal Specification Formal Verification 4 Evaluation 5 Future Work and Conclusion 24 / 49
Example √ √ √ phys ≡ {{ x ′ = 2 / 2 v , y ′ = 2 / 2 v , v ′ = − 2 / 2 g & 0 ≤ x ≤ 100 } √ ∪ { x ′ = dx v , y ′ = dy , v ′ = − dy g , dx ′ = − dy v / 100 2 , √ dy ′ = dx v / 100 2 & 100 ≤ x ≤ 200 } √ √ √ ∪ { x ′ = 2 / 2 v , y ′ = − 2 / 2 v , v ′ = 2 / 2 g & 200 ≤ x ≤ 300 }} ∗ 25 / 49
Example phys ≡ {{ Line( . . . ) & 0 ≤ x ≤ 100 } ∪ { Arc( . . . ) & 100 ≤ x ≤ 200 } ∪ { Line( . . . ) & 200 ≤ x ≤ 300 }} ∗ 26 / 49
Recommend
More recommend
